Trying to install and configure AWS toolkit to Visual Studio Code.
Command Command palette->Create Credentials profile brings two files :
credentials file content
[default]
aws_access_key_id = XXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXX
config file content
[default]
region = eu-central-1
output = text
Choose Command palette->AWS profile profile:default generates error:
2022-02-03 10:03:51 [ERROR]: log level: info
2022-02-03 10:03:52 [INFO]: Retrieving AWS endpoint data
2022-02-03 10:03:52 [INFO]: OS: Windows_NT x64 10.0.19043
2022-02-03 10:03:52 [INFO]: Visual Studio Code Extension Host Version: 1.63.2
2022-02-03 10:03:52 [INFO]: AWS Toolkit Version: 1.35.0
2022-02-03 10:03:52 [INFO]: telemetry cache not found: 'c:\Users\g\AppData\Roaming\Code\User\globalStorage\amazonwebservices.aws-toolkit-vscode\telemetryCache'
2022-02-03 10:04:18 [ERROR]: Error getting AccountId: [InvalidClientTokenId: The security token included in the request is invalid.
at constructor.h (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:5:9005)
at constructor.callListeners (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:21079)
at constructor.emit (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:20788)
at constructor.emitEvent (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:6641)
at constructor.e (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:2227)
at U.runTo (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:18:1767)
at c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:18:1979
at constructor.<anonymous> (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:2438)
at constructor.<anonymous> (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:6696)
at constructor.callListeners (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:21183)
at constructor.emit (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:20788)
at constructor.emitEvent (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:6641)
at constructor.e (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:2227)
at U.runTo (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:18:1767)
at c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:18:1979
at constructor.<anonymous> (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:2438)
at constructor.<anonymous> (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:6696)
at constructor.callListeners (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:21183)
at e (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:6:20964)
at IncomingMessage.<anonymous> (c:\Users\g\.vscode\extensions\amazonwebservices.aws-toolkit-vscode-1.35.0\dist\extension.js:1:209012)
at IncomingMessage.emit (events.js:327:22)
at IncomingMessage.EventEmitter.emit (domain.js:467:12)
at endReadableNT (internal/streams/readable.js:1327:12)
at processTicksAndRejections (internal/process/task_queues.js:80:21)] {
code: 'InvalidClientTokenId',
time: 2022-02-03T08:04:18.158Z,
requestId: '00c18899-6f97-40c1-9788-b2156b350ebb',
statusCode: 403,
retryable: false,
retryDelay: 83.95345343935642
}
2022-02-03 10:04:18 [ERROR]: login: failed to connect with "profile:default": Could not determine Account Id for credentials
How to connect AWS toolkit to my VSCode?
You'll need to get the access and secret key from AWS and insert them in place of the XXXXXXX placeholders.
You can get this information in the AWS Cloud -> IAM -> Access Management -> Users -> Select your user -> Security credentials -> Access Keys
You will find here the Access Key ID, but the Secret Key is only shown once when you are creating this item. You maybe have it stored somewhere, or you can create another Access Key pair and use that.
I have done this and I can connect to AWS Toolkit fine.
AWS Toolkit Config
Couple of things I tried to make it work:
Ensure that the credentials file is in C:\Users\UserName\ .aws\ {credentials}
Was prompted that default region for this profile was xxx. Changed it accordingly.
Restarted the VS code(yeah, I know) :D
Chose the profile and it opened okay.
Related
I followed this answer already. But it didn't help, also, I re-installed gcloud CLI, but now I am not able to install CLI anymore because of the following error.
Here is my output for ./google-cloud-sdk/bin/gcloud init
ERROR: Reachability Check failed.
Cannot reach https://cloudresourcemanager.googleapis.com/v1beta1/projects with httplib2 (SSLCertVerificationError)
Cannot reach https://www.googleapis.com/auth/cloud-platform with httplib2 (SSLCertVerificationError)
Cannot reach https://cloudresourcemanager.googleapis.com/v1beta1/projects with requests (SSLError)
Cannot reach https://www.googleapis.com/auth/cloud-platform with requests (SSLError)
Network connection problems may be due to proxy or firewall settings.
Also, I am not behind any corporate proxy.
It was working perfectly few days ago, until today.I did not changed any settings whatsoever, I didn't install any new services whatsoever.
Output for ./google-cloud-sdk/bin/gcloud info.
./google-cloud-sdk/bin/gcloud info
Google Cloud SDK [354.0.0]
Python Version: [3.7.9 (v3.7.9:13c94747c7, Aug 15 2020, 01:31:08) [Clang 6.0 (clang-600.0.57)]]
Python Location: [/Users/myname/.config/gcloud/virtenv/bin/python3]
Site Packages: [Enabled]
Installation Root: [/Users/myname/Downloads/google-cloud-sdk]
Installed Components:
gsutil: [4.67]
core: [2021.08.20]
bq: [2.0.71]
System PATH: [/Users/myname/.config/gcloud/virtenv/bin:/Users/myname/Downloads/apache-maven-3.8.4/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/go/bin:/usr/local/munki:/usr/local/opt/go/libexec/bin:/Users/myname/go/bin]
Python PATH: [/Users/myname/Downloads/./google-cloud-sdk/lib/third_party:/Users/myname/Downloads/google-cloud-sdk/lib:/Library/Frameworks/Python.framework/Versions/3.7/lib/python37.zip:/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7:/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/lib-dynload:/Users/myname/.config/gcloud/virtenv/lib/python3.7/site-packages]
Cloud SDK on PATH: [False]
Kubectl on PATH: [/usr/local/bin/kubectl]
Installation Properties: [/Users/myname/Downloads/google-cloud-sdk/properties]
User Config Directory: [/Users/myname/.config/gcloud]
Active Configuration Name: [default]
Active Configuration Path: [/Users/myname/.config/gcloud/configurations/config_default]
Account: [None]
Project: [None]
Current Properties:
[core]
disable_usage_reporting: [True]
Logs Directory: [/Users/myname/.config/gcloud/logs]
Last Log File: [/Users/myname/.config/gcloud/logs/2022.08.10/15.35.06.807614.log]
git: [git version 2.32.0 (Apple Git-132)]
ssh: [OpenSSH_8.1p1, LibreSSL 2.7.3]
Update on this, just disable the ssl validation and everything will work.
gcloud config set auth/disable_ssl_validation True
When I use
aws-vault exec --no-session --debug role_name
I get:
2020/06/09 13:57:13 [keyring] Found item "aws-vault (default)"
aws-vault: error: exec: Failed to get credentials for role_name: InvalidClientTokenId: The security token included in the request is invalid.
status code: 403, request id: 05bf31bd-091e-4f18-83c5-7add3e1bccb8
First of all I thought about incorrect password, but when tried to put an incorrect password purposely, Mac Os ask again for the correct password.
I have the ~/.aws/config and ~/.aws/credentials with the correct setup.
Had the same error after rotating AWS credentials.
Deleted ~/Library/Keychains/aws-vault.keychain-db and executed aws-vault add default which created a new keychain and aws-vault started working again.
If you are on MacOS, you can probably edit the keychain directly.
I am using ansible to create an aws ami and instance from that ami
but however when i run "ansible-playbook -i ../hosts ec2.yml" command it fails with a following error,
"An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ClientError: An error occurred (AuthFailure) when calling the CreateImage operation: AWS was not able to validate the provided access credentials
fatal: [localhost]: FAILED! => {"boto3_version": "1.9.50", "botocore_version": "1.12.50", "changed": false, "error": {"code": "AuthFailure", "message": "AWS was not able to validate the provided access credentials"}, "msg": "Error registering image: An error occurred (AuthFailure) when calling the CreateImage operation: AWS was not able to validate the provided access credentials", "response_metadata": {"http_headers": {"date": "Sat, 24 Nov 2018 11:03:48 GMT", "server": "AmazonEC2", "transfer-encoding": "chunked"}, "http_status_code": 401, "request_id": "17ae8e55-7cf4-44e3-9c23-498a2913b4f0", "retry_attempts": 0}}
to retry, use: --limit #/etc/ansible/yml/ec2.retry
"
I have setup awscli and configure my access and secret key with default region (with administrative rights).
I am using ubuntu 14.04 version and my date command output is, "Sat Nov 24 16:47:44 IST 2018"
Any solution?
I have created a service account in Gcloud.
Installed Gcloud on my mac.
When ever I run my packer template, it complains about this account which I have no idea where it is coming from.
Packer template:
{
"builders": [
{
"type": "googlecompute",
"account_file": "/Users/Joe/Downloads/account.json",
"project_id": "rare-truck-123456",
"source_image": "centos-7-v20180129",
"zone": "us-west1-a",
"ssh_username": "centos"
}
]
}
Error:
➜ packer git:(master) ✗ packer build release_google_image.json
googlecompute output will be in this color.
==> googlecompute: Checking image does not exist...
==> googlecompute: Creating temporary SSH key for instance...
==> googlecompute: Using image: centos-7-v20180129
==> googlecompute: Creating instance...
googlecompute: Loading zone: us-west1-a
googlecompute: Loading machine type: n1-standard-1
googlecompute: Loading network: default
googlecompute: Requesting instance creation...
googlecompute: Waiting for creation operation to complete...
==> googlecompute: Error creating instance: 1 error(s) occurred:
==> googlecompute:
==> googlecompute: * The resource '123412341234-compute#developer.gserviceaccount.com' of type 'serviceAccount' was not found.
Build 'googlecompute' errored: Error creating instance: 1 error(s) occurred:
* The resource '123412341234-compute#developer.gserviceaccount.com' of type 'serviceAccount' was not found.
==> Some builds didn't complete successfully and had errors:
--> googlecompute: Error creating instance: 1 error(s) occurred:
* The resource '123412341234-compute#developer.gserviceaccount.com' of type 'serviceAccount' was not found.
==> Builds finished but no artifacts were created.
Why is it trying to use 123412341234-compute#developer.gserviceaccount.com?
I created a service account with compute admin v1 permissions under my project in google cloud and I downloaded my json file and renamed it to accounts.json. The name of that service account is different (release-builder#rare-truck-123456.iam.gserviceaccount.com), but packer seems to ignore it and go after some strange account.
Even my cli command gcloud info gives back the right service account:
Google Cloud SDK [188.0.1]
Platform: [Mac OS X, x86_64] ('Darwin', 'Alexs-MacBook-Pro.local', '16.7.0', 'Darwin Kernel Version 16.7.0: Thu Jan 11 22:59:40 PST 2018; root:xnu-3789.73.8~1/RELEASE_X86_64', 'x86_64', 'i386')
Python Version: [2.7.14 (default, Sep 25 2017, 09:53:22) [GCC 4.2.1 Compatible Apple LLVM 9.0.0 (clang-900.0.37)]]
Python Location: [/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python]
Site Packages: [Disabled]
Installation Root: [/Users/Joe/Downloads/google-cloud-sdk]
Installed Components:
core: [2018.02.08]
gsutil: [4.28]
bq: [2.0.28]
System PATH: [/Users/Joe/Downloads/google-cloud-sdk/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin]
Python PATH: [/Users/Joe/Downloads/google-cloud-sdk/lib/third_party:/Users/Joe/Downloads/google-cloud-sdk/lib:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python27.zip:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/plat-darwin:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/plat-mac:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/plat-mac/lib-scriptpackages:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-tk:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-old:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-dynload]
Cloud SDK on PATH: [True]
Kubectl on PATH: [False]
Installation Properties: [/Users/Joe/Downloads/google-cloud-sdk/properties]
User Config Directory: [/Users/Joe/.config/gcloud]
Active Configuration Name: [default]
Active Configuration Path: [/Users/Joe/.config/gcloud/configurations/config_default]
Account: [release-builder#rare-truck-123456.iam.gserviceaccount.com]
Project: [rare-truck-123456]
Current Properties:
[core]
project: [rare-truck-123456]
account: [release-builder#rare-truck-123456.iam.gserviceaccount.com]
disable_usage_reporting: [True]
[compute]
region: [us-west1]
zone: [us-west1-a]
Logs Directory: [/Users/Joe/.config/gcloud/logs]
Last Log File: [/Users/Joe/.config/gcloud/logs/2018.02.09/15.51.18.911677.log]
git: [git version 2.14.3 (Apple Git-98)]
ssh: [OpenSSH_7.4p1, LibreSSL 2.5.0]
Google Compute Engine instances use default services account to have a better integration with Google Platform.
As you can read on the documentation [1]: "(...)If the user will be managing virtual machine instances that are configured to run as a service account, you must also grant the roles/iam.serviceAccountActor role."
You need to add the role "Service Account User" to your service account in order to be able to create Google Compute Engine instances.
[1] https://cloud.google.com/iam/docs/understanding-roles#compute_name_short_roles
When I try to deploy to amazon EC2 using salt cloud, I’m getting this error:
[root#salt salt]# salt-cloud -p ec2_private_win_r3.xlarge server00009
[ERROR ] AWS Response Status Code and Error: [401 401 Client Error: Unauthorized] {'Errors': {'Error': {'Message': 'AWS was not able to validate the provided access credentials', 'Code': 'AuthFailure'}}, 'RequestID': '33b43015-518e-4865-88e7-b6432e61b0db'}
[ERROR ] AWS Response Status Code and Error: [401 401 Client Error: Unauthorized] {'Errors': {'Error': {'Message': 'AWS was not able to validate the provided access credentials', 'Code': 'AuthFailure'}}, 'RequestID': '4b88b080-ad32-4388-a133-4322b1c08c04'}
[ERROR ] There was a profile error: 'NoneType' object has no attribute 'copy'
I’ve verified the AWS keys that I’m using and I’m able to list and even launch new instances using the aws command line with the keys that I’m using in the cloud provider file:
## Gov Cloud Non Prod environment
company-govcloud-nonprod-us-east-1:
# Set up the location of the salt master
minion:
master: 10.0.2.15
# Set up grains information, which will be common for all nodes
# using this driver
grains:
node_type: broker
# Valid options are:
# private_ips - The salt-cloud command is run inside the EC2
# public_ips - The salt-cloud command is run outside of EC2
#
ssh_interface: private_ips
# Optionally configure the Windows credential validation number of
# t-tdetries and delay between retries. This defaults to 10 retries
# with a one second delay betdwee retries
win_deploy_auth_retries: 10
win_deploy_auth_retry_delay: 1
# Set the EC2 access credentials (see below)
id: 'AKIAIATLQ4FTDDA6BV7A'
key: 'asdfasdsfadsadasasdafadsadfafasdasda’
# Make sure this key is owned by root with permissions 0400.
#
private_key: /etc/salt/company-timd
keyname: company-timd
#securitygroup: core-sg-default
# Optionally configure default region
# Use salt-cloud --list-locations <driver> to obtain valid regions
#
location: us-east-1
availability_zone: us-east-1c
# Configure which user to use to run the deploy script. This setting is
# dependent upon the AMI that is used to deploy. It is usually safer to
# configure this individually in a profile, than globally. Typical users
# are:
# Amazon Linux -> ec2-user
# RHEL -> ec2-user
# CentOS -> ec2-user
# Ubuntu -> ubuntu
#
ssh_username: root
# Optionally add an IAM profile
#iam_profile: 'arn:aws:iam::xxxxxxxxxxxx:role/rl-company-admin'
driver: ec2
And this is the profile that I’m trying to use:
## Windows Server 2012 Alteryx & Tableau
ec2_private_win_r3.xlarge:
provider: company-govcloud-nonprod-us-east-1
image: ami-xxxxxxx
size: r3.xlarge
network_interfaces:
- DeviceIndex: 0
SubnetId: subnet-xxxxxxx
SecurityGroupId: sg-xxxxxx
PrivateIpAddresses:
- Primary: True
AssociatePublicIpAddress: False
block_device_mappings:
- DeviceName: /dev/sda1
Ebs.VolumeSize: 120
Ebs.VolumeType: gp2
- DeviceName: /dev/sdf
Ebs.VolumeSize: 250
Ebs.VolumeType: gp2
tag: {'Engagement': '999999999999', 'Owner': 'Tim', 'Name': 'non-production', 'Environment': 'COMPANY-Grouper'}
I tried commenting out the IAM profile in the cloud provider definition. I’ve checked and the AWS credentials I’m using has administrator access in IAM.
Here's my version report
[root#salt ~]# salt-cloud --versions-report
Salt Version:
Salt: 2016.11.5
Dependency Versions:
Apache Libcloud: 0.20.1
cffi: 1.6.0
cherrypy: 3.2.2
dateutil: 2.6.0
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
ioflo: Not Installed
Jinja2: 2.7.2
libgit2: Not Installed
libnacl: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.4.8
mysql-python: Not Installed
pycparser: 2.14
pycrypto: 2.6.1
pycryptodome: 3.4.3
pygit2: Not Installed
Python: 2.7.5 (default, Nov 6 2016, 00:28:07)
python-gnupg: Not Installed
PyYAML: 3.11
PyZMQ: 15.3.0
RAET: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 4.2.1
ZMQ: 4.1.4
System Versions:
dist: centos 7.2.1511 Core
machine: x86_64
release: 3.10.0-327.el7.x86_64
system: Linux
version: CentOS Linux 7.2.1511 Core
How can I solve this problem?
Are you trying to launch a windows EC2 instance with a ssh_username? That may be breaking it.