Question 71672 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

Issue when running terraform: Error: updating Auto Scaling Group XXX: AccessDenied: You are not authorized to use launch template: XXX – Amazon web services

I have picked up a piece of work started by a contractor who has since left, and I was told the pipeline was working, but when I run it I get this error:

╷
│ Error: updating Auto Scaling Group (XXX): AccessDenied: You are not authorized to use launch template: XXX
│   status code: 403, request id: f7f48427-6c5a-4154-ab70-5a5226929e9f
│ 
│   with aws_autoscaling_group.autoscale_group,
│   on main.tf line 243, in resource "aws_autoscaling_group" "autoscale_group":
│  243: resource "aws_autoscaling_group" "autoscale_group" {
│

I cannot track down where the permissions issue is, the role that runs terraform has a policy that allows everything:

{
    "Statement": [
        {
            "Action": [
                "*"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "AllowAllPermissions"
        }
    ],
    "Version": "2012-10-17"
}

It also seems like the AMI ID is ok and I am able to launch an instance myself using my admin role, from the console using the launch template.

Has anyone had this issue and can maybe point me in the direction of where to look for the permissions error?

Tags:

3

Answers


  1. Chosen as BEST ANSWER
    0

    In my case it was because unknown to anyone was the fact that an SCP was very recently deployed restricting the creation of instances without an encrypted root device, which led to this error.

    I fixed by updating the terraform launch template resource to include the following:

    block_device_mappings {
    device_name = "/dev/sda1"
    ebs {
      encrypted = true
    }
  }

    I will leave this question here and answered because it might be helpful to somebody in future.


  2. 0

    Since you are able to perform the task manually via your Admin credentials via the AWS console, I would check your terraform aws provider config to ensure that no other profile/credentials are being set there.

    Login or Signup to reply.
  3. 0

    Same here for a couple of days.
    Created a Launch template via Terraform but cannot create a ASG with it. 🙁

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search