When trying to run one of the Neptune-ML examples in a notebook instance
when running the line
endpoints=neptune_ml.setup_pretrained_endpoints(s3_bucket_uri, setup_node_classification, setup_node_regression, setup_link_prediction, setup_edge_classification, setup_edge_regression)
it returns None, and I can see the following error in the logs:
ERROR:root:Unable to determine the Neptune ML IAM Role.
I guess this is related to roles and permissions but I cannot find anything in the documentation(I followed the official documentation when doing setup).
Question is: how to solve this issue or how to debug it?
This is likely because the notebook instance doesn't have the NeptuneML IAM role parameter set as an environment variable.
Try running export NEPTUNE_ML_ROLE_ARN=<your neptune ml role arn> in the terminal of the notebook instance you're using. Alternatively you can add that to the .bashrc file on the notebook instance.
Your Neptune cluster should have a cluster parameter group assigned to it that has the neptune_ml_iam_role parameter defined. It is this role that is being used.
Related
I followed the documentation on AWS how to add system manager.
So i did EC2-> Instances and select my running EKS instance to add the policies to the existing IAM Role eksctl-eks-gxxxxx-nodegroup-NodeInstanceRole-S0UHXXXXHJJD3T .
As you can see on the screenshot we can see AmazonSSMManagedInstanceCore on the IAM Role
eksctl-eks-gxxxxx-nodegroup-NodeInstanceRole-S0UHXXXXHJJD3T .
However when i go to system Manager -> Session manager i dont see my instance :(
i get this error
There are no instances which are associated with the required IAM
role.
i also watched a movie on youtube I do everything the same I don't see where is the problem
Have you installed SSM Agent on the EC2 instance?
You need the SSM Agent running on the system to perform any actions by SSM. More details on how to install and configure the agent could be found here: https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html
I tried to detach one of my IAM role from my instance (still running) and got a response of successful detachment.
Afterwards I tried to attach a new IAM role to the exactly same instance, however, this message occured: The association <AssociationId> is not the active association.
After using aws ec2 describe-iam-instance-profile-associations to check the IAM instance profile associations, I found that the state is disassociating. And I rechecked the associations the other day, it's still stuck at disassociating.
Then I tried aws ec2 associate-iam-instance-profile to associate my instance with a new role, but all I got is another instance association stuck at associating.
I also tried replace-iam-instance-profile-association and the same showed up: The association <AssociationId> is not the active association.
And rebooting instance did not work either.
Any solutions?
Thanks.
I've fixed this issue by launching a new instance base on the EBS snapshot of the problematic instance, which is the last thing I wanna do.
Anyway, this could be considered as a workaround. :(
It really sucks that you have to pay to create AWS technical support cases.
Found an easy solution for this!
Hope this helps some people finding this.
After getting stuck in the "disassociating" or "associating" state, use the aws CLI to find the associations that causes the problem (They will be stuck at the state ""disassociating" or "associating""):
aws ec2 describe-iam-instance-profile-associations
After finding them use:
aws ec2 disassociate-iam-instance-profile --association-id iip-assoc-xxxxxx
to remove them. Not quite intuitive but you can actually remove the ones in the state "disassociating" after that you can add a new role/instance-profile.
Error : Unable to detach, there are no existing instance profile associations.
While you are trying to add Role to EC2 instance
Debug and Verify:
run > aws iam list-instance-profiles
command output :
{
"InstanceProfiles": []
}
run > aws iam list-instance-profiles-for-role --role-name Your-Role-Name
command output :
{
"InstanceProfiles": []
}
Solution :
run > aws iam create-instance-profile --instance-profile-name profile-name-sameas-role-name
run > aws iam add-role-to-instance-profile --instance-profile-name profile-name-sameas-role-name --role-name role-name
Done !!
Go Back to EC2 dashboard and try to Add the IAM Role again. This time it should work.
Version: 5.7.mysql_aurora.2.07.2
i am trying to link lambda function when my RDS get inserted using lambda_async. but was not able to reach it with an error
#63996 - Lambda API returned error: Missing IAM Credentials for specified aws_default_lambda_role
i have followed each and every step carefully but getting above error. :(
i have followed the documentation at
https://docs.amazonaws.cn/en_us/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Lambda.html
and
Call AWS Lambda from Aurora RDS Stored Procedure Permissions Issue.
please help!!
actually i was placing lambda role in parameter group value. replacing with RDS IAM role solve my issue thanks!!
I found this answer: https://www.reddit.com/r/aws/comments/b2b9k4/new_rds_cluster_management_screen_missing_manage/ on which they sugest to add an IAM role for the cluster.
For that go to the RDS Cluster and under Connectivity & security tab, go to Manage IAM roles and add the desired role.
Note: You may need to enable also IAM DB authentication under Configuration tab.
Note2: Reboot your DB instance to apply changes.
I want to "associate an instance profile" with my environment (to speed up upload performance for my website) but can't find useful instructions on how anywhere in the AWS documentation (or here on SO).
How do I "associate an instance profile" with an environment on AWS?
Not clear what you are trying to accomplish, but if you are look to just 'associate an instance profile', here you go:
http://docs.aws.amazon.com/IAM/latest/UserGuide/instance-profiles.html
An instance profile is a container for an IAM role. Instance profiles
are used to pass role information to an Amazon EC2 instance when the
instance starts. When you use the Amazon EC2 console to launch an
instance with an IAM role, you can select a role to associate with the
instance. In the console, the list that's displayed is actually a list
of instance profile names.
If you use the AWS Management Console to create a role, the console
creates an instance profile automatically and gives it the same name
as the role it corresponds to. However, if you use the CLI, API, the
AWS SDK, or a third-party tool to create roles and instance profiles,
you create the roles and instance profiles as separate actions, and
you might give them different names. In that case, you need to know
the names of your instance profiles as well as the names of roles they
contain so that you can choose the correct instance profile when you
launch an Amazon EC2 instance.
If you are seeing this error when trying to set up a Elastic Beanstalk environment, it could be that the IAM user does not have sufficient permissions. You should add the IAM Policy named IAMFullAccess for that user.
You can check one option that works here for AWS Beanstalk. This is using AWS Console.
Create IAM Role for "EC2" as AWS Service and attach
"AWSElasticBeanstalkFullAccess" policy to it.
Create an AWS Beanstalk environment with tier/platform/application of choice. (I did with Web Tier choosing Docker platform using python:3-onbuild).
Hit "Configure More Options" > "Modify" Security.
Choose "IAM instance profile" which was created in Step 1. (Keep Service role
"aws-elasticbeanstalk-service-role" as this is needed! It has some key policies!)
"Save" and "Create Environment".
Similarly, it should work for AWS CLI and AWS SDK as well. Key here is the instance profile role you choose for EC2 (or say instance IAM role/instance profile) during Beanstalk Environment creation.
You can create customer managed policy extending or reusing AWSElasticBeanstalkFullAccess policy based on need. Refer AWSElasticBeanstalkFullAccess to understand it better. Also, check out some more AWS Managed policies starting with AWSElasticBeanStalk*.
Somehow default aws-elasticbeanstalk-ec2-role policy is not working/taking effect as desired for me.
For what it's worth, the AWS console now displays an alert (see image) that has a link to help you associate the instance profile with your environment. Therefore, if you see this message in the CLI, you probably need to log into the Management Console, navigate to Elastic Beanstalk, and choose your environment. You will then see the message and be able to use the link to resolve the issue.
Note 1: You may need to redeploy your app after associating the profile. I did.
Note 2: It really does make deployments faster.
Orome,
As E.J Brennan pointed out in his post, you must have a role created first, and attach the necessary IAM policies to that role, then you create the instance profile:
aws iam create-instance-profile --instance-profile-name YOUR_INSTANCE_PROFILE_NAME
Then add the role you created in the beginning to the instance profile:
aws iam add-role-to-instance-profile --instance-profile-name YOUR_INSTANCE_PROFILE_NAME --role-name YOUR_ROLE
Then attach the instance profile to your instance:
aws ec2 associate-iam-instance-profile --instance-id YOUR_INSTANCE_ID --iam-instance-profile Name="YOUR_INSTANCE_PROFILE_NAME"
Is this what you are looking for?
As E.J Brennan also pointed out, the AWS management console does the instance profile for you behind the scenes.
In order to run AWS monitoring scripts (http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/mon-scripts-perl.html) on one of my ec2 existing instance, I need a IAM role associated to the instance.
I found a lot of documentation to launch an instance with a role... But nothing to link a role to an existing instance.
Is it possible?
If not, what can I do? Launch a new instance with a role and transfert the volumes to it?
If not, what can I do? Launch a new instance with a role and transfert
the volumes to it?
This is one option but it might take you a long time if you have a lot instances.
The other option is to simply use IAM by creating a new user then add the Amazon CloudWatch PutMetricData operation permission to that user. Then, create AWS credentials for that user and finally use them as per the docs that you specified:
Optional: If you aren't using an IAM role, update the
awscreds.template file that you downloaded earlier. The content of
this file should use the following format:
AWSAccessKeyId=YourAccessKeyID
AWSSecretKey=YourSecretAccessKey
Also set the environment variable AWS_CREDENTIAL_FILE to point that awscreds.template in the environment of the user that is running the mon-scripts-perl
There is a new method available associate-iam-instance-profile to Associates an IAM instance profile with a running or stopped instance.
Example:
aws ec2 associate-iam-instance-profile --instance-id YourInstanceId --iam-instance-profile Name=YourNewRole-Instance-Profile
Doco
AWS doesn't allow you to modify the instance role after launching the instance.
You can either:
1) Launch a new instance with the role needed by taking the AMI of the already running instance and reassigning the EIP.
or
2) Create a headless user, generate access key and secret key for the user with specific permssion, and use those keys.
Earlier there was no solution. You had to create and AMI and launch the server again with the appropriate role.
On Feb 9, AWS launched these new CLI options which can help you solve your problem.
See this link: https://aws.amazon.com/blogs/security/new-attach-an-aws-iam-role-to-an-existing-amazon-ec2-instance-by-using-the-aws-cli/