aws ec2 create-volume not creating volume - amazon-web-services

Question

I'm running the following command:
aws ec2 create-volume --region eu-west-1 --availability-zone eu-west-1a --snapshot-id snap-02583b4b1fb1d2d84
And I get the response:
{
"SnapshotId": "snap-02583b4b1fb1d2d84",
"Size": 40,
"VolumeType": "standard",
"Encrypted": true,
"State": "creating",
"VolumeId": "vol-0d7bec77ac1164266",
"CreateTime": "2017-05-09T10:17:03.521Z",
"AvailabilityZone": "eu-west-1a"
}
However, any subsequent command; such as:
aws ec2 wait volume-available --volume-ids vol-0d7bec77ac1164266
Returns:
Waiter VolumeAvailable failed: The volume 'vol-0d7bec77ac1164266' does not exist.
When I look on the web UI volumes dashboard; I cannot see the volume. I have checked in every region.
Anyone ever seen this behaviour before?
UPDATE
The command appears to work as expected if I execute it on another computer using a different IAM user with * permissions on * resources.
UPDATE 2
It appears that the volume is encrypted and the permissions may not be compensating for an encrypted volume.

Answer 1

I had this same issue attempting to create a Volume from an encrypted Snapshot. The create volume command appears to complete successfully:
{
"AvailabilityZone": "eu-west-1a",
"Encrypted": true,
"VolumeType": "gp2",
"VolumeId": "vol-xxxxx",
"State": "creating",
"Iops": 100,
"SnapshotId": "snap-xxxxx",
"CreateTime": "2017-07-14T21:03:24.430Z",
"Size": 10
}
However, the Volume never appears to be created and cannot be found attempting to describe it.
The issue was that the KMS key the Snapshot was created with was pending deletion. By cancelling the KMS deletion and re-enabling the key the Volume was created successfully.

Answer 2

OK. I have got it working; but I still believe that there is an issue with the CLI.
The volume being created is encrypted. Therefore permissions are needed to handle encrypted volumes.
The only way I could get it to work was to add the following permissions:
"kms:CreateGrant",
"kms:ListGrants",
"kms:RevokeGrant",
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"ec2:AttachVolume",
"ec2:DescribeVolume*",
"ec2:Describe*",
"ec2:CreateVolume",
"ec2:DescribeSnapshots",
"ec2:AttachVolume"
The tool doesn't report any permission errors when executing the command on an encrypted volume.
I've raised the issue: https://github.com/aws/aws-cli/issues/2592

Answer 3

I was unable to reproduce your problem.
I did the following steps:
Created an IAM user with these permissions as an inline policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
],
"Resource": [
"*"
]
}
]
}
Created a volume from a snapshot (as that User):
aws ec2 create-volume --region ap-southeast-2 --availability-zone ap-southeast-2a --snapshot-id snap-abcd1234 --profile xyz
{
"AvailabilityZone": "ap-southeast-2a",
"Encrypted": false,
"VolumeType": "standard",
"VolumeId": "vol-03e2eee8e64f593d3",
"State": "creating",
"SnapshotId": "snap-abcd1234",
"CreateTime": "2017-05-11T05:17:23.960Z",
"Size": 30
}
The volume was created successfully.
That user doesn't have permissions to call VolumeAvailable, so I used a different user:
aws ec2 wait volume-available --volume-ids vol-03e2eee8e64f593d3 --region ap-southeast-2 --profile normal
The command completed immediately without error.