Unable to create instances with IAM role specified

Rancher 2.x
1

I’m unable to create instances with IAM role specified, I created a role, associated with the strategy below:
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: “ec2:Describe*”,
“Resource”: “"
},
{
“Effect”: “Allow”,
“Action”: “ec2:AttachVolume”,
“Resource”: "”
},
{
“Effect”: “Allow”,
“Action”: “ec2:DetachVolume”,
“Resource”: “"
},
{
“Effect”: “Allow”,
“Action”: [
"ec2:”
],
“Resource”: [
“"
]
},
{
“Effect”: “Allow”,
“Action”: [
"elasticloadbalancing:”
],
“Resource”: [
“*”
]
}
]
}

Rancher error:
Error creating machine: Error in driver during machine creation: Error launching instance: UnauthorizedOperation: You are not authorized to perform this operation. Encoded authorization failure message: _qV3F3BWuZVYnL3nBDrrG5avBLwtc7r3E01qx94mGGSAeqjBaEQswqIFhfmLXWvzfvFqIqmJBYGYXFCIsdUYIDBJhpvDhMv5mCyiltdIYcYL2aQbIQf5PAAOXjIhuQRY9-9VgeRv3smosekOmss9qzA0pbDnNtznaBFQnmXgqJtKfdC4SqRH1hKnQIDlXuqMPVyvGtwWxv3OyXl3HJ84DGwV2v2X3TyTyoxDZ1rN7h-kV67Z3EHeP2tNNckpvWYEIrT5sOg3NSysh0rnuZJr4RQ3IQAQdWajZOxE4Uwx5jEicKJZU2CH0xxQ_7uMu-X6e1ZuVEgEGAs4sLhU5hDMcm_8i0q0AOB6CZRL-F-Dhk_wfdy8yCDCDCwTEVEVBvhoKB_vmm8U5PaV6oN3guXYQufBQx3rnHBQ_pnaBcUoDt9fwdaBftytAF58mXAT2smJSJoqXhY9hnGWfnIsyyTizijD7Qx-yRvgU8ssSgSyoTwhE_UCb8DOPCJTHZx1apZ6Mg

My role seems to be good, so I don’t understand. thank you

1 Like
2

The Access Key you are using is not allowed to pass IAM roles to machines. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html

3

Thank you, do you have an example for me. I just tried to add the passrole permissions to my role but no success. :frowning:

4 
    {
      "Effect":"Allow",
      "Action":"iam:PassRole",
      "Resource":"arn:aws:iam::XXX:role/your_role_name"
    }
1 Like
5

I am facing the same issue, even though I have the policies and roles in place on a brand new installation.

“UnauthorizedOperation: You are not authorized to perform this operation.” when adding a node template.

From:

https://rancher.com/docs/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/#example-iam-policy

Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:Describe*",
                "ec2:ImportKeyPair",
                "ec2:CreateKeyPair",
                "ec2:CreateSecurityGroup",
                "ec2:CreateTags",
                "ec2:DeleteKeyPair"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole",
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:ap-southeast-2::image/ami-*",
                "arn:aws:ec2:ap-southeast-2:AWS_ACCOUNT_ID:instance/*",
                "arn:aws:ec2:ap-southeast-2:AWS_ACCOUNT_ID:placement-group/*",
                "arn:aws:ec2:ap-southeast-2:AWS_ACCOUNT_ID:volume/*",
                "arn:aws:ec2:ap-southeast-2:AWS_ACCOUNT_ID:subnet/*",
                "arn:aws:ec2:ap-southeast-2:AWS_ACCOUNT_ID:key-pair/*",
                "arn:aws:ec2:ap-southeast-2:AWS_ACCOUNT_ID:network-interface/*",
                "arn:aws:ec2:ap-southeast-2:AWS_ACCOUNT_ID:security-group/*",
                "arn:aws:iam::AWS_ACCOUNT_ID:role/RancherEC2Role"
            ]
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:TerminateInstances",
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Resource": "arn:aws:ec2:ap-southeast-2:AWS_ACCOUNT_ID:instance/*"
        }
    ]
}
6

Tried adding “iam:GetRole” to the policy in the example as well, no luck.

Any feedback is welcome.

Thanks!

7

What was the fix for this. I am launching Rancher 2.5. I have verified my IAM policy. It has the PassRole and all the other settings required. But I am getting the same error indicated above.