AWS CLI Client.UnauthorizedOperation even when keys are set

Question

I am trying to setup AWS CLI tools and was following instructions at http://docs.aws.amazon.com/AWSEC2/latest/CommandLineReference/set-up-ec2-cli-linux.html#setting_up_ec2_command_linux

However, after following all the steps and setting up my AWS_ACCESS_KEY and AWS_SECRET_KEY, I get

$ ec2-describe-regions
Client.UnauthorizedOperation: You are not authorized to perform this operation. (Service: AmazonEC2; Status Code: 403; Error Code: UnauthorizedOperation; Request ID: 55f02cc4-2e9f-4a0a-8b55-46bcc1973f50)

I then tried regenerating new credentials, but still getting the same error. I couldn't seem to find information about anyone else having this issue. I tried passing the keys using -O and -W, but that doesn't work either.

Any idea what I might be doing wrong?

Answer 1

I am on free tier and found it easier to grant administrator policy to single user, which supports access from all of the amazon command line tools. you can downgrade the policy at a later time if you feel the policy is too lenient.

1. visit https://console.aws.amazon.com/iam/home
2. select policies in left hand menu
3. create administrator policy from amazons existing policies
4. select administrator checkbox and attach to your user

Assuming you have set up your access keys, you should now have full command line access for given user.

before

› ec2-describe-regions
Client.UnauthorizedOperation: You are not authorized to perform this operation. (Service: AmazonEC2; Status Code: 403; Error Code: UnauthorizedOperation; Request ID: 3398ed18-1caf-4c04-865b-a54f796c653c)

after

› ec2-describe-regions
REGION  eu-central-1    ec2.eu-central-1.amazonaws.com
REGION  sa-east-1   ec2.sa-east-1.amazonaws.com
REGION  ap-northeast-1  ec2.ap-northeast-1.amazonaws.com
REGION  eu-west-1   ec2.eu-west-1.amazonaws.com
REGION  us-east-1   ec2.us-east-1.amazonaws.com
REGION  us-west-1   ec2.us-west-1.amazonaws.com
REGION  us-west-2   ec2.us-west-2.amazonaws.com
REGION  ap-southeast-2  ec2.ap-southeast-2.amazonaws.com
REGION  ap-southeast-1  ec2.ap-southeast-1.amazonaws.com

amazons UX takes some time before you get used to it