aws cfn-init failing for AccessDenied - amazon-web-services

Question

I have to run cfn-init for an autoscaling group but it is failing:
/opt/aws/bin/cfn-init -v --stack ms-lbas-split1-EC2LauncConfigStack-1GB6170KAE3EU --resource LaunchConfig --region us-west-2
AccessDenied: Instance i-02c0239a16cd96a53 is not allowed to call DescribeStackResource for ms-lbas-split1-EC2LauncConfigStack-1GB6170KAE3EU
The policy is on * and, indeed, i can call describe-stack-resource on the same entity and it is working fine:
[root#ip-172-31-18-99 ec2-user]# aws cloudformation describe-stack-resource --stack-name ms-lbas-split1-EC2LauncConfigStack-1GB6170KAE3EU --logical-resource-id LaunchConfig --region us-west-2
{
"StackResourceDetail": {
"StackId": "arn:aws:cloudformation:us-west-2:020779576776:stack/ms-lbas-split1-EC2LauncConfigStack-1GB6170KAE3EU/cdf015d0-9d88-11ed-8084-0af2362739b7",
"ResourceStatus": "CREATE_COMPLETE",
"DriftInformation": {
"StackResourceDriftStatus": "NOT_CHECKED"
},
"ResourceType": "AWS::AutoScaling::LaunchConfiguration",
"LastUpdatedTimestamp": "2023-01-26T14:53:46.144Z",
"StackName": "ms-lbas-split1-EC2LauncConfigStack-1GB6170KAE3EU",
"PhysicalResourceId": "ms-lbas-split1-EC2LauncConfigStack-1GB6170KAE3EU-LaunchConfig-IqXSDhGUFDY1",
"Metadata": "{\"Comment\":\"Install a simple application\",\"AWS::CloudFormation::Init\":{\"config\":{\"files\":{\"/etc/cfn/cfn-hup.conf\":{\"mode\":\"000400\",\"owner\":\"root\",\"content\":\"[main]\\nstack=arn:aws:cloudformation:us-west-2:020779576776:stack/ms-lbas-split1/86b538d0-9d88-11ed-8250-0a502f832635\\nregion=us-west-2\\n\",\"group\":\"root\"},\"/etc/cfn/hooks.d/cfn-auto-reloader.conf\":{\"mode\":\"000400\",\"owner\":\"root\",\"content\":\"[cfn-auto-reloader-hook]\\ntriggers=post.update\\npath=Resources.LaunchConfig.Metadata.AWS::CloudFormation::Init\\naction=/opt/aws/bin/cfn-init -v --stack ms-lbas-split1-EC2LauncConfigStack-1GB6170KAE3EU --resource LaunchConfig --region us-west-2\\nrunas=root\\n\",\"group\":\"root\"},\"/var/www/html/index.html\":{\"mode\":\"000644\",\"owner\":\"root\",\"content\":\"<img src=\\\"\\nhttps://s3-us-west-2.amazonaws.com/cloudformation-examples-us-west-2\\n/cloudformation_graphic.png\\\" alt=\\\"AWS CloudFormation Logo\\\"/>\\n<h1>Congratulations, you have successfully launched the AWS CloudFormation sample.</h1>\",\"group\":\"root\"}},\"services\":{\"sysvinit\":{\"cfn-hup\":{\"files\":[\"/etc/cfn/cfn-hup.conf\",\"/etc/cfn/hooks.d/cfn-auto-reloader.conf\"],\"ensureRunning\":\"true\",\"enabled\":\"true\"},\"httpd\":{\"ensureRunning\":\"true\",\"enabled\":\"true\"}}},\"packages\":{\"yum\":{\"httpd\":[]}}}}}",
"LogicalResourceId": "LaunchConfig"
}
I have this problem only when I am using those nested cloudformation template:
Main one:
"Resources": {
"WebServerGroup" : {
"Type" : "AWS::AutoScaling::AutoScalingGroup",
"Properties" : {
"VPCZoneIdentifier" : { "Ref" : "AWSsubnetid" },
"LaunchConfigurationName" : {
"Fn::GetAtt": ["EC2LauncConfigStack", "Outputs.LaunchConfig"]
},
"MinSize" : "2",
"MaxSize" : "2",
"TargetGroupARNs" : [ { "Ref" : "ALBTargetGroup" } ]
},
"CreationPolicy" : {
"ResourceSignal" : {
"Timeout" : "PT60M"
}
},
"UpdatePolicy": {
"AutoScalingRollingUpdate": {
"MinInstancesInService": "1",
"MaxBatchSize": "1",
"PauseTime" : "PT15M",
"WaitOnResourceSignals": "true"
}
}
},
"EC2LauncConfigStack": {
"Type": "AWS::CloudFormation::Stack",
"Properties": {
"TemplateURL": {
"Fn::Sub": "https://ms-tst-launcongi-12343.s3.us-west-2.amazonaws.com/ec2_EC2LauncConfigStack-v2.json"
},
"Parameters":{
"StackName": {
"Ref" : "AWS::StackName"
},
"StackId": {
"Ref" : "AWS::StackId"
},
"InstanceSecGroup" : {
"Ref" : "InstanceSecurityGroup"
}
}
}
},
"ApplicationLoadBalancer" : {
"Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer",
"DependsOn":"InstanceSecurityGroupHttp",
"Properties" : {
"Subnets" : { "Ref" : "AWSsubnetid"},
"SecurityGroups" : [ { "Ref" : "InstanceSecurityGroupHttp" } ]
}
},
"ALBListener" : {
"Type" : "AWS::ElasticLoadBalancingV2::Listener",
"Properties" : {
"DefaultActions" : [{
"Type" : "forward",
"TargetGroupArn" : { "Ref" : "ALBTargetGroup" }
}],
"LoadBalancerArn" : { "Ref" : "ApplicationLoadBalancer" },
"Port" : "80",
"Protocol" : "HTTP"
}
},
"ALBTargetGroup" : {
"Type" : "AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties" : {
"HealthCheckIntervalSeconds" : 30,
"HealthCheckTimeoutSeconds" : 5,
"HealthyThresholdCount" : 3,
"Port" : 80,
"Protocol" : "HTTP",
"UnhealthyThresholdCount" : 5,
"VpcId" : {"Ref" : "AWSvpcid"}
}
},
"InstanceSecurityGroup" : {
"Type" : "AWS::EC2::SecurityGroup",
"Properties" : {
"GroupDescription" : "Enable SSH access and HTTP access on the inbound port",
"SecurityGroupIngress" : [ {
"IpProtocol" : "tcp",
"FromPort" : "80",
"ToPort" : "80",
"SourceSecurityGroupId" : {"Fn::Select" : [0, {"Fn::GetAtt" : ["ApplicationLoadBalancer", "SecurityGroups"]}]}
},{
"IpProtocol" : "tcp",
"FromPort" : "22",
"ToPort" : "22",
"CidrIp" : { "Ref" : "RemoteAccessCIDR"}
} ],
"VpcId" : { "Ref" : "AWSvpcid" }
}
},
"InstanceSecurityGroupHttp" : {
"Type" : "AWS::EC2::SecurityGroup",
"Properties" : {
"GroupDescription" : "Enable HTTP access on the inbound port",
"SecurityGroupIngress" : [ {
"IpProtocol" : "tcp",
"FromPort" : "80",
"ToPort" : "80",
"CidrIp": "0.0.0.0/0"
} ],
"VpcId" : { "Ref" : "AWSvpcid" }
}
}
},
Nested:
[...]
"PolicyDocument": {
"Statement": [
{
"Effect": "Allow",
"Action": [
"*"
],
"Resource": "*"
},
[...]
"LaunchConfig" : {
"Type" : "AWS::AutoScaling::LaunchConfiguration",
"Metadata" : {
"Comment" : "Install a simple application",
"AWS::CloudFormation::Init" : {
"config" : {
"packages" : {
"yum" : {
"httpd" : []
}
},
"files" : {
"/var/www/html/index.html" : {
"content" : { "Fn::Join" : ["\n", [
"<img src=\"", {"Fn::FindInMap" : ["Region2Examples", {"Ref" : "AWS::Region"}, "Examples"]}, "/cloudformation_graphic.png\" alt=\"AWS CloudFormation Logo\"/>",
"<h1>Congratulations, you have successfully launched the AWS CloudFormation sample.</h1>"
]]},
"mode" : "000644",
"owner" : "root",
"group" : "root"
},
"/etc/cfn/cfn-hup.conf" : {
"content" : { "Fn::Join" : ["", [
"[main]\n",
"stack=", { "Ref" : "StackId" }, "\n",
"region=", { "Ref" : "AWS::Region" }, "\n"
]]},
"mode" : "000400",
"owner" : "root",
"group" : "root"
},
"/etc/cfn/hooks.d/cfn-auto-reloader.conf" : {
"content": { "Fn::Join" : ["", [
"[cfn-auto-reloader-hook]\n",
"triggers=post.update\n",
"path=Resources.LaunchConfig.Metadata.AWS::CloudFormation::Init\n",
"action=/opt/aws/bin/cfn-init -v ",
" --stack ", { "Ref" : "StackName" },
" --resource LaunchConfig ",
" --region ", { "Ref" : "AWS::Region" }, "\n",
"runas=root\n"
]]},
"mode" : "000400",
"owner" : "root",
"group" : "root"
}
},
"services" : {
"sysvinit" : {
"httpd" : { "enabled" : "true", "ensureRunning" : "true" },
"cfn-hup" : { "enabled" : "true", "ensureRunning" : "true",
"files" : ["/etc/cfn/cfn-hup.conf", "/etc/cfn/hooks.d/cfn-auto-reloader.conf"]}
}
}
}
}
},
"Properties" : {
"ImageId" :{ "Fn::FindInMap" : [ "AWSRegionArch2AMI", { "Ref" : "AWS::Region" },
{ "Fn::FindInMap" : [ "AWSInstanceType2Arch", { "Ref" : "AWSInstanceType" }, "Arch" ] } ] },
"SecurityGroups" : [ { "Ref" : "InstanceSecGroup" } ],
"IamInstanceProfile": { "Ref": "HostProfile" },
"InstanceType" : { "Ref" : "AWSInstanceType" },
"KeyName" : { "Ref" : "AWSKeyPairName" },
"UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
"#!/bin/bash -xe\n",
"yum update -y aws-cfn-bootstrap\n",
"/opt/aws/bin/cfn-init -v ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource LaunchConfig ",
" --region ", { "Ref" : "AWS::Region" }, "\n",
"/opt/aws/bin/cfn-signal -e $? ",
" --stack ", { "Ref" : "StackName" },
" --resource WebServerGroup ",
" --region ", { "Ref" : "AWS::Region" }, "\n"
]]}}
}
}
},
I have chopped out few things. Exactly the same code is running fine when I am using one single stack:
{
"Resources": {
"WebServerGroup" : {
"Type" : "AWS::AutoScaling::AutoScalingGroup",
"Properties" : {
"VPCZoneIdentifier" : { "Ref" : "AWSsubnetid" },
"LaunchConfigurationName" : { "Ref" : "LaunchConfig" },
"MinSize" : "2",
"MaxSize" : "2",
"TargetGroupARNs" : [ { "Ref" : "ALBTargetGroup" } ]
},
"CreationPolicy" : {
"ResourceSignal" : {
"Timeout" : "PT15M"
}
},
"UpdatePolicy": {
"AutoScalingRollingUpdate": {
"MinInstancesInService": "1",
"MaxBatchSize": "1",
"PauseTime" : "PT15M",
"WaitOnResourceSignals": "true"
}
}
},
"LaunchConfig" : {
"Type" : "AWS::AutoScaling::LaunchConfiguration",
"Metadata" : {
"Comment" : "Install a simple application",
"AWS::CloudFormation::Init" : {
"config" : {
"packages" : {
"yum" : {
"httpd" : []
}
},
"files" : {
"/var/www/html/index.html" : {
"content" : { "Fn::Join" : ["\n", [
"<img src=\"", {"Fn::FindInMap" : ["Region2Examples", {"Ref" : "AWS::Region"}, "Examples"]}, "/cloudformation_graphic.png\" alt=\"AWS CloudFormation Logo\"/>",
"<h1>Congratulations, you have successfully launched the AWS CloudFormation sample.</h1>"
]]},
"mode" : "000644",
"owner" : "root",
"group" : "root"
},
"/etc/cfn/cfn-hup.conf" : {
"content" : { "Fn::Join" : ["", [
"[main]\n",
"stack=", { "Ref" : "AWS::StackId" }, "\n",
"region=", { "Ref" : "AWS::Region" }, "\n"
]]},
"mode" : "000400",
"owner" : "root",
"group" : "root"
},
"/etc/cfn/hooks.d/cfn-auto-reloader.conf" : {
"content": { "Fn::Join" : ["", [
"[cfn-auto-reloader-hook]\n",
"triggers=post.update\n",
"path=Resources.LaunchConfig.Metadata.AWS::CloudFormation::Init\n",
"action=/opt/aws/bin/cfn-init -v ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource LaunchConfig ",
" --region ", { "Ref" : "AWS::Region" }, "\n",
"runas=root\n"
]]},
"mode" : "000400",
"owner" : "root",
"group" : "root"
}
},
"services" : {
"sysvinit" : {
"httpd" : { "enabled" : "true", "ensureRunning" : "true" },
"cfn-hup" : { "enabled" : "true", "ensureRunning" : "true",
"files" : ["/etc/cfn/cfn-hup.conf", "/etc/cfn/hooks.d/cfn-auto-reloader.conf"]}
}
}
}
}
},
"Properties" : {
"ImageId" :{ "Fn::FindInMap" : [ "AWSRegionArch2AMI", { "Ref" : "AWS::Region" },
{ "Fn::FindInMap" : [ "AWSInstanceType2Arch", { "Ref" : "AWSInstanceType" }, "Arch" ] } ] },
"SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ],
"InstanceType" : { "Ref" : "AWSInstanceType" },
"KeyName" : { "Ref" : "AWSKeyPairName" },
"UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
"#!/bin/bash -xe\n",
"yum update -y aws-cfn-bootstrap\n",
"/opt/aws/bin/cfn-init -v ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource LaunchConfig ",
" --region ", { "Ref" : "AWS::Region" }, "\n",
"/opt/aws/bin/cfn-signal -e $? ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource WebServerGroup ",
" --region ", { "Ref" : "AWS::Region" }, "\n"
]]}}
}
},
"ApplicationLoadBalancer" : {
"Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer",
"Properties" : {
"Subnets" : { "Ref" : "AWSsubnetid"},
"SecurityGroups" : [ { "Ref" : "InstanceSecurityGroupHttp" } ]
}
},
"ALBListener" : {
"Type" : "AWS::ElasticLoadBalancingV2::Listener",
"Properties" : {
"DefaultActions" : [{
"Type" : "forward",
"TargetGroupArn" : { "Ref" : "ALBTargetGroup" }
}],
"LoadBalancerArn" : { "Ref" : "ApplicationLoadBalancer" },
"Port" : "80",
"Protocol" : "HTTP"
}
},
"ALBTargetGroup" : {
"Type" : "AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties" : {
"HealthCheckIntervalSeconds" : 30,
"HealthCheckTimeoutSeconds" : 5,
"HealthyThresholdCount" : 3,
"Port" : 80,
"Protocol" : "HTTP",
"UnhealthyThresholdCount" : 5,
"VpcId" : {"Ref" : "AWSvpcid"}
}
},
"InstanceSecurityGroup" : {
"Type" : "AWS::EC2::SecurityGroup",
"Properties" : {
"GroupDescription" : "Enable SSH access and HTTP access on the inbound port",
"SecurityGroupIngress" : [ {
"IpProtocol" : "tcp",
"FromPort" : "80",
"ToPort" : "80",
"SourceSecurityGroupId" : {"Fn::Select" : [0, {"Fn::GetAtt" : ["ApplicationLoadBalancer", "SecurityGroups"]}]}
},{
"IpProtocol" : "tcp",
"FromPort" : "22",
"ToPort" : "22",
"CidrIp" : { "Ref" : "RemoteAccessCIDR"}
} ],
"VpcId" : { "Ref" : "AWSvpcid" }
}
},
"InstanceSecurityGroupHttp" : {
"Type" : "AWS::EC2::SecurityGroup",
"Properties" : {
"GroupDescription" : "Enable HTTP access on the inbound port",
"SecurityGroupIngress" : [ {
"IpProtocol" : "tcp",
"FromPort" : "80",
"ToPort" : "80",
"CidrIp": "0.0.0.0/0"
} ],
"VpcId" : { "Ref" : "AWSvpcid" }
}
}
},
"Outputs" : {
"URL" : {
"Description" : "URL of the website",
"Value" : { "Fn::Join" : [ "", [ "http://", { "Fn::GetAtt" : [ "ApplicationLoadBalancer", "DNSName" ]}]]}
}
}
}