Why can't I run AWS CLI commands on my Amazon EC2 instance?

Short description

When you run AWS CLI commands on your EC2 instance, you might receive an error message similar to the following examples:

• "Unable to locate credentials. You can configure credentials by running 'aws configure'"
• "An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation"
  Note: Use the error message to identify the API call that failed. In the preceding example, an error occurred for the DescribeInstances API call.
• "An error occurred (AuthFailure) when calling the DescribeInstances operation: AWS was not able to validate the provided access credentials"
• "An error occurred (ExpiredToken) when calling the GetCallerIdentity operation: The security token included in the request is expired"

To troubleshoot these errors, take the following actions based on the error that you received.

Note: If you use AWS PrivateLink to connect to the instance, then make sure that you can reach the service's virtual private cloud (VPC) endpoints. For information about instances in a private subnet, see How do I create Amazon Virtual Private Cloud (Amazon VPC) endpoints so that I can use AWS Systems Manager to manage private Amazon EC2 instances without internet access?

Resolution

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Troubleshoot "unable to locate credentials" errors

Run the following list command to check whether the AWS CLI can retrieve credentials:

aws configure list

If the output doesn't contain your credentials, then configure your credentials for the AWS CLI.

If you use AWS Identity and Access Management (IAM) instance profiles, then make sure that the IAM role association has completed. To validate that the role is visible, run the following get-caller-identity command:

aws sts get-caller-identity

If the output doesn't contain the instance profile role, then reattach the instance role to the instance profile.

Troubleshoot "UnauthorizedOperation" and "AuthFailure" errors

Take the following actions:

• Make sure that the IAM role or IAM user has the permissions to run the commands.
• Make sure that the time on your instance is correct.
• Make sure that you correctly configured your AWS Security Token Service (AWS STS) token.
• Make sure that you used the correct credentials when you ran the command. To check the credentials that you're using, run the following get-caller-identity command:

  aws sts get-caller-identity 

  Note: If your instance uses multiple sets of credentials, then credential precedence might affect the credentials that the instance uses to make the API call. For more information, see Why is my Amazon EC2 instance using IAM user credentials instead of role credentials?

Troubleshoot "ExpiredToken" errors

If you use temporary credentials, then they expire at the time interval that you specified when you created them. To obtain a new STS token after your IAM role's credentials expire, assume a new IAM role.

Related information

How can I troubleshoot access denied or unauthorized operation errors with an IAM policy?