Reconfigure EC2 instance with AWS credentials

Question

I have EC2 instance.

I'm trying to call aws s3 from it but getting an error

Unable to locate credentials

I tried aws configure which does show everything as empty.

I see IAM role for S3 full permissions assigned to this instance.

Do I need any additional configuration?

Answer 1

If you run aws on an Amazon EC2 instance that has an assigned role, then it should find the credentials automatically.

You can also use this to view the credentials from the instance:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

The role name should be listed. Then append it to the command:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME/

You should then be presented with AccessKeyId , SecretAccessKey , etc.

If that information does not appear, it suggests that your role is not correctly attached to the instance. Try unassigning the role and then assign it to the instance again.

Answer 2

First read and follow John Rotenstein's advice.

The SDK (from which the CLI is built from) searches for credentials in the following order:

1. Environment variables (AWS_ACCESS_KEY_ID ....)
2. Default Profile (credentials file)
3. ECS Container Credentials (if running on ECS)
4. Instance Profile

After verifying that your EC2 instance has credentials in the metadata, double check 1 & 2 to make sure that there are no other credentials present even if empty.

Note: This link argues with my last point (empty credentials file). I never create (store) credentials on an EC2 instance and I only use IAM Roles.

Instance Metadata