{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/2693","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/2693/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/2693/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/2693/events","html_url":"https://github.com/hashicorp/terraform/issues/2693","id":94465786,"number":2693,"title":"Invalid security token issue on EC2 that has an IAM instance profile","user":{"login":"killercentury","id":412445,"avatar_url":"https://avatars.githubusercontent.com/u/412445?v=3","gravatar_id":"","url":"https://api.github.com/users/killercentury","html_url":"https://github.com/killercentury","followers_url":"https://api.github.com/users/killercentury/followers","following_url":"https://api.github.com/users/killercentury/following{/other_user}","gists_url":"https://api.github.com/users/killercentury/gists{/gist_id}","starred_url":"https://api.github.com/users/killercentury/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/killercentury/subscriptions","organizations_url":"https://api.github.com/users/killercentury/orgs","repos_url":"https://api.github.com/users/killercentury/repos","events_url":"https://api.github.com/users/killercentury/events{/privacy}","received_events_url":"https://api.github.com/users/killercentury/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/waiting-response","name":"waiting-response","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":23,"created_at":"2015-07-11T11:59:32Z","updated_at":"2015-12-12T07:19:03Z","closed_at":null,"body":"When I run plan and apply on my Mac for creating a ECS cluster, everything seems fine. But when I run the exact same thing on a EC2 instance which has an IAM instance profile, it will complain following error:\r\n```\r\nUnrecognizedClientException: The security token included in the request is invalid\r\n\tstatus code: 400, request id: []\r\n```\r\nI actually want to use the \"access_key\" and \"secret_key\" specified in my terraform configs instead of inheriting these from the IAM role. But it seems those variables in terraform configs weren't used properly, and the credentials from IAM role as well, since both have full permission for the operation.\r\n\r\nSo I tried a few different combinations as follows.\r\n\r\n1. I change the value of \"access_key\" and \"secret_key\" in my terraform configs to the ones in the IAM role. And it works fine. (Of course, EC2 will change these values after a while.)\r\n\r\n2. I set the environment variable AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to some random value (anything! such as AWS_ACCESS_KEY_ID=hello and AWS_SECRET_ACCESS_KEY=world). Then it seems working fine with the values I specified in the my terraform.tfvars file now.\r\n\r\nSo without looking into the code, I guess it has to do with some credentials detection logic for the IAM role and it overrides the value specified in the terraform.tfvars file.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/164116972","html_url":"https://github.com/hashicorp/terraform/issues/2693#issuecomment-164116972","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/2693","id":164116972,"user":{"login":"avdhoot","id":1314627,"avatar_url":"https://avatars.githubusercontent.com/u/1314627?v=3","gravatar_id":"","url":"https://api.github.com/users/avdhoot","html_url":"https://github.com/avdhoot","followers_url":"https://api.github.com/users/avdhoot/followers","following_url":"https://api.github.com/users/avdhoot/following{/other_user}","gists_url":"https://api.github.com/users/avdhoot/gists{/gist_id}","starred_url":"https://api.github.com/users/avdhoot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avdhoot/subscriptions","organizations_url":"https://api.github.com/users/avdhoot/orgs","repos_url":"https://api.github.com/users/avdhoot/repos","events_url":"https://api.github.com/users/avdhoot/events{/privacy}","received_events_url":"https://api.github.com/users/avdhoot/received_events","type":"User","site_admin":false},"created_at":"2015-12-12T07:19:02Z","updated_at":"2015-12-12T07:19:02Z","body":"\"empty\" means ec2 instance launched with IAM role but no permission\nattached to that role.\n\nOn Sat, Dec 12, 2015 at 12:07 AM, Clint <notifications@github.com> wrote:\n\n> Note: ec2 instance is launched with empty instance role.\n>\n> Can you elaborate on what an \"empty\" instance role is? In your previous\n> message you mention \"launched with IAM role\".\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/hashicorp/terraform/issues/2693#issuecomment-164012892>\n> .\n>\n"}}