<aws permission> is missing

[caleb-gosnell]

Hi,
Running 2.1.0 in an amazon-linux instance from my VPC I'm seeing 0 instead of the numbers I would expect, and many errors like so:

cloudwatch:DescribeAlarms is missing 5 14 minutes ago
iam:GetUser is missing 21 minutes ago
ec2:DescribeInstances is missing 11 14 minutes ago
tag:GetResources is missing 4 14 minutes ago
support:DescribeCases is missing 8 14 minutes ago
ec2:DescribeElasticIPs is missing 7 14 minutes ago
lambda:ListFunctions is missing 7 14 minutes ago
ecs:DescribeClusters or ecs:DescribeTasks or ecs:DescribeServices is missing 7 14 minutes ago
cloudwatch:GetMetricStatistics is missing 57 14 minutes ago
ec2:DescribeReservedInstances is missing 7 14 minutes ago
ec2:DescribeSpotFleetRequests is missing 7 14 minutes ago
ec2:DescribeScheduledInstances is missing 7 14 minutes ago
eks:ListClusters is missing 7 14 minutes ago
s3:ListAllMyBuckets is missing

Here are the permissions applied in the instance profile:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "1",
"Effect": "Allow",
"Action": [
"ec2:DescribeRegions",
"ec2:DescribeInstances",
"ec2:DescribeVolumes",
"ec2:DescribeVpcs",
"ec2:DescribeSecurityGroups",
"ec2:DescribeNatGateways",
"ec2:DescribeRouteTables",
"ec2:DescribeSnapshots",
"ec2:DescribeNetworkAcls",
"ec2:DescribeKeyPairs",
"ec2:DescribeInternetGateways"
],
"Resource": ""
},
{
"Sid": "2",
"Effect": "Allow",
"Action": [
"ec2:DescribeAddresses",
"ec2:DescribeSnapshots",
"elasticloadbalancing:DescribeLoadBalancers",
"autoscaling:DescribeAutoScalingGroups",
"ce:GetCostAndUsage",
"s3:ListAllMyBuckets",
"apigateway:GET",
"support:DescribeTrustedAdvisorCheckResult"
],
"Resource": ""
},
{
"Sid": "3",
"Effect": "Allow",
"Action": [
"lambda:ListFunctions",
"dynamodb:ListTables",
"dynamodb:DescribeTable",
"rds:DescribeDBInstances",
"cloudwatch:DescribeAlarms",
"cloudfront:ListDistributions",
"ecs:DescribeClusters",
"ecs:DescribeServices",
"ecs:DescribeTasks"
],
"Resource": ""
},
{
"Sid": "4",
"Effect": "Allow",
"Action": [
"sqs:ListQueues",
"route53:ListHostedZones",
"sns:ListTopics",
"iam:ListGroups",
"iam:ListRoles",
"iam:ListPolicies",
"iam:ListUsers"
],
"Resource": ""
},
{
"Sid": "5",
"Effect": "Allow",
"Action": [
"acm:ListCertificates",
"mq:ListBrokers",
"cloudwatch:GetMetricStatistics",
"cloudtrail:LookupEvents",
"ce:GetCostAndUsage",
"ce:GetCostForecast",
"datapipeline:ListPipelines",
"ec2:DescribeReservedInstances",
"ec2:DescribeSpotFleetRequests",
"ec2:DescribeScheduledInstances",
"eks:ListClusters",
"elasticache:DescribeCacheClusters",
"es:ListDomainNames",
"cloudwatchlogs:DescribeLogGroups"
],
"Resource": ""
},
{
"Sid": "6",
"Effect": "Allow",
"Action": [
"glue:GetCrawlers",
"glue:GetJobs",
"organizations:DescribeOrganization",
"iam:GetUser",
"kinesis:ListStreams",
"kinesis:ListShards",
"kms:ListKeys",
"redshift:DescribeClusters",
"tag:GetResources",
"route53:ListResourceRecordSets",
"s3:ListAllMyBuckets",
"support:DescribeCases",
"support:DescribeTrustedAdvisorChecks",
"swf:ListDomains"
],
"Resource": ""
}
]
}

After ssh-ing to the instance, I am able to use awscli to successfully call apis that the UI is complaining about not having permissions for.

[mlabouardy]

are you using the docker image ? @caleb-sixfeetup

[caleb-gosnell]

Nope.
I'm spinning an ec2 instance, and pulling 2.1.0 release from GH.

I should have mentioned, that the one metric that is coming through is the month-to-date bill forecast.

[mlabouardy]

hmm, I will try to reproduce it

meanwhile, can you try to set the environment variable "AWS_DEFAULT_REGION" @caleb-sixfeetup

[caleb-gosnell]

@mlabouardy , Thank you.
Defining "AWS_DEFAULT_REGION" made this work as expected.

Somehow I never noticed how much less straightforward it is to get region out of instance metadata than credentials.

[mlabouardy]

@caleb-sixfeetup thanks for the update, I will update the documentation