Trying to follow AWS CLI documentation for EC2 Instance to access S3 Bucket

Question

Attempting to utilize the AWS CLI documentation the following works:
aws  s3 ls s3://mybucketname

With the following is specified in conf file
[default]
region = us-east-1
credential_source = Ec2InstanceMetadata

I've setup a Role, policy and attached that to the instance

However, if I add the following that the documentation specifies
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html
[default]
role_arn = arn:aws:iam::12345:role/myrolename
region = us-east-1
credential_source = Ec2InstanceMetadata

aws  s3 ls s3://mybucketname
Will fail with 
An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::123456:assumed-role/myrolename/i-12345 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456:role/myrolename

Why do I care that this syntax doesn't work, but he first one does?
I'm using CLI to model some product behavior, that I need to specify a Role to Access a bucket.
Figured this should work first

Answer

Hi, for the error "User: arn:aws:sts::123456:assumed-role/myrolename/i-12345 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456:role/myrolename", it indicates that the assumed role session (arn:aws:sts::123456:assumed-role/myrolename/i-12345) tries to assume role myrolename again. 
When the IAM role myrolename is attached in an EC2 instance, by default, AWS CLI will be able to use that role to perform actions such as S3 operations so that there is no need to reconfigure the AWS CLI to assume the same IAM role.

Answer

Hello Bigbmn,

Firstly, when you use the AWS CLI, and you've specified the role ARN in the configuration file as you've done, AWS CLI will try to assume that role when executing commands. This essentially means the CLI is requesting temporary credentials for that role to perform actions.

Your error indicates that there's an issue with the permissions associated with assuming that role.

**Possible Solution:**
Adjust the trust relationship of the role. Here's a generic example of what it might look like:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```
This is a basic trust policy that allows EC2 instances to assume the role. Depending on your architecture, you might want to narrow down which entities (e.g., specific EC2 roles) can assume this role.

After making adjustments, try the AWS CLI command again. If the issue persists, you might want to verify permissions and trust relationships in the AWS Management Console.

Trying to follow AWS CLI documentation for EC2 Instance to access S3 Bucket

Relevant content