boto issue with IAM role

Question

I\'m trying to use AWS\' recently announced \"IAM roles for EC2\" feature, which lets security credentials automatically get delivered to EC2 instances. (see http://aws.ama

Answer 1

I don't know if this answer will help anyone but I was getting the same error, I had to solve my problem a little differently. First, my amazon instance did not have any IAM roles. I thought I could just use the access key and the secret key but I kept getting this error with only those two keys. I read I needed a security token as well, but I didn't have one because I didn't have any IAM roles. This is what I did to correct the issue:

1. Create an IAM role with AmazonS3FullAccess permissions.
2. Start a new instance and attach my newly created role.

3. Even after doing this it still didn't work. I had to also connect to the proper region with the code below:

   import boto.s3.connection
   conn = boto.s3.connect_to_region('your-region')
   conn.get_all_buckets()

Answer 2

If you are using boto 2.5.1 or later it's actually much easier than this. Boto will automatically find the credentials in the instance metadata for you and use them as long as no other credentials are found in environment variables or in a boto config file. So, you should be able to simply do this on the EC2 instance:

>>> import boto
>>> c = boto.connect_s3()
>>> rs = c.get_all_buckets()

The reason that your manual approach is failing is that the credentials associated with the IAM Role is a temporary session credential and consists of an access_key, a secret_key and a security_token and you need to supply all three of those values to the S3Connection constructor.