An error occurred (AccessDeniedException) when calling the CreateDiskSnapshot operation

0

I want to migrate my lightsail to ipv6 only instance, I following this: https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-create-an-instance-root-volume-snapshot.html, but when I run aws lightsail create-disk-snapshot --region ap-southeast-1 --instance-name bh --disk-snapshot-name backup

It shows: An error occurred (AccessDeniedException) when calling the CreateDiskSnapshot operation: User: arn:aws:sts::750876363357:assumed-role/AmazonLightsailInstanceRole/i-0d884500fa12eb433 is not authorized to perform: lightsail:CreateDiskSnapshot on resource: arn:aws:lightsail:ap-southeast-1:750876363357:* because no identity-based policy allows the lightsail:CreateDiskSnapshot action.

How to solve this?

6 Answers
0

After running that command, I saw the item on the snapshot tab, I want to create a disk for the US zone, but after submitting the create disk requirement, the Lightsail system broke..., when I click the snapshot tab, it shows

Lightsail system broke

Hmm, something's up… Lightsail is currently experiencing a problem.

We're fixing it, we promise! In the meantime, the AWS Service Health Dashboard might provide more information

answered 11 days ago
  • I checked the status of Lightsail in the Service health dashboard and it didn't appear to be at fault. https://health.aws.amazon.com/health/status
    Please try clearing your browser's cache and cookies, or accessing from a different browser or PC.

  • Yes, the Lightsail in the Service health dashboard shows nothing, but when I enter the snapshot tab, it shows as the image. The instance tab is okay. Changing the computer or cleaning the cache does nothing to this

0

Still errors, and the charging starts in May, this causes us to pay for ipv4... Please fix your system issue!

answered 8 days ago
  • Sorry to hear about the errors.

    To unblock you from being able to access the data from the root disk-snapshot on your new IPv6 instance, you could use the CLI to create a new disk and then since the Instance page on console is NOT throwing errors, do the disk attachment and other actions via the console. The command to create the disk will be:

    aws lightsail create-disk-from-snapshot --region ap-southeast-1 --disk-snapshot-name backup --disk-name <replace-with-your-desired-disk-name>  --availability-zone ap-southeast-1a --size-in-gb 20
    

    ===

    For the Snapshot page errors, could you please help check which request the console is making is failing and what error it is seeing by trying to debug using the browser Network tool as described here for Chrome - https://developer.chrome.com/docs/devtools/network ?

    If that doesn't work you could try following https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-create-har-file.html and share that har file for us to take a look. Please ensure to sanitize/remove all sensitive data from the har file before sharing via this or on any public forum or instead reach us via AWS Support under the free plan.

  • I want to create a disk for the US zone, not ap-southeast-1a, maybe that is the root cause? Because I want my new instance located in US.

0

Hello.

This is because the IAM user or IAM Role you are using is not allowed to execute "lightsail:CreateDiskSnapshot".
I'm assuming you're running the AWS CLI on Lightsail from the message "User: arn:aws:sts::750876363357:assumed-role/AmazonLightsailInstanceRole/i-0d884500fa12eb433", but try using CloudShell.
If you use CloudShell, the IAM policy of the IAM user you are using is used, so if the IAM user has permission to execute "lightsail:CreateDiskSnapshot", you can create a snapshot.
https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html

profile picture
EXPERT
answered 11 days ago
profile pictureAWS
EXPERT
reviewed 11 days ago
0

Hi,

You appear to be running the command from a Lightsail instance without specifying an AWS profile identifier or providing any explicit AWS credentials. This makes it use the default instance profile to run the command and this profile does not have the required permissions.

You have a few options as alternatives:

  1. Use AWS CloudShell via the Lightsail console to run your command instead. Please refer this doc
  2. Continue using Lightsail instance, but set AWS credentials on the session or setup and specify an AWS profile on the command. Please refer doc1 and doc2
  3. Run the command on your laptop or some server where you have AWS credentials or profile setup

Thanks.

profile pictureAWS
EXPERT
AWS-SUM
answered 11 days ago
0

Still error in the snapshot page Enter image description here

answered 10 days ago
0

Enter image description here Enter image description here Enter image description here Enter image description here

answered 7 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content