Issue
I am trying to get started with the AWS CLI on OS X. I installed aws
via pip. I have created a new user in IAM and attached the pre-built AdministratorAccess - AWS Managed policy policy. Next, I have copied the generated Access Key ID and the Secret Access Key.
The user I created is not in any groups. Their policy looks like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
Next, I ran aws configure
from the command line, and entered the access key and secret key that I copied, plus a region code of eu-west-1
(which seems unlikely to be relevant since IAM users are global), and an output format of text
.
Then I have tried running a simple test command to set up a new group:
aws ec2 create-security-group --group-name my-sg --description "My security group" --debug
However, this fails with the following error:
A client error (UnauthorizedOperation) occurred when calling the CreateSecurityGroup operation: You are not authorized to perform this operation.
Other commands fail in the same way.
My only theory is that it's a copy and paste error in the keys, but I've tried doing the whole process above twice and failed in the same way both times. What am I doing wrong? Is there a way I can debug which part of the process is failing?
Solution
Your AWS CLI is getting credentials from somewhere else. See Configuration Settings and Precedence
Make sure it is not getting the credentials from environment variables or from other locations. The AWS CLI looks for credentials and configuration settings in the following order:
- Command Line Options – region, output format and profile can be specified as command options to override default settings.
- Environment Variables – AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, etc.
- The AWS credentials file – located at ~/.aws/credentials on Linux, OS X, or Unix, or at C:\Users\USERNAME .aws\credentials on Windows. This file can contain multiple named profiles in addition to a default profile.
- The CLI configuration file – typically located at ~/.aws/config on Linux, OS X, or Unix, or at C:\Users\USERNAME .aws\config on Windows. This file can contain a default profile, named profiles, and CLI specific configuration parameters for each.
- Instance profile credentials – these credentials can be used on EC2 instances with an assigned instance role, and are delivered through the Amazon EC2 metadata service.
Answered By - helloV Answer Checked By - Mildred Charles (WPSolving Admin)