Powershell script works on one EC2 instance but not another

0

I have a simple Powershell script to upload a file to S3. I have 2 EC2 instances that use the same IAM profile. The instances and S3 bucket all live in the same AWS account.

RDP into one instance, open Powershell prompt as admin, and the script works. RDP to the other instance, open Powershell prompt as admin, and the script fails with: Write-S3Object : Access Denied

To check networking/routing, both instances can open a browser and surf the web. I assume the credentials used are the role assigned to the instances.

If it matters, this is the ps1 script (access point obfuscated) $ArtifactFile = "c:\temp\junk1.txt" $S3BucketAP = "arn:aws:s3:us-east-1:1234567890:accesspoint/my-s3-ap" $Key = "Junk3\junk1.txt" Write-S3Object -BucketName $S3BucketAP -Key $Key -File $ArtifactFile

Where else can I look to debug?

3回答
0
承認された回答

On reddit someone suggested I look at environment vars, which got me thinking to check for any profiles. When I dumped the credentials it showed "NetSDKCredentialsFile"

Get-AWSCredential -ListProfileDetail

ProfileName StoreTypeName         ProfileLocation
----------- -------------         ---------------
For_Move    NetSDKCredentialsFile
default     NetSDKCredentialsFile

I found the file here and deleted it: %userprofile%\AppData\Local\AWSToolkit\RegisteredAccounts.json

Everything works as expected now. Must have got installed by accident.

回答済み 2年前
0

I went ahead and swapped to use forward slashes.
Rebooted the instance that is not working and it still doesn't work.
I've run out of things to test. I don't want to create an IAM user with secret key and have to use that but I suppose that is the next step.

回答済み 2年前
  • No, don't do that - that's definitely an anti-pattern and it leaves you rotating credentials. Not a good idea. The whole point of an instance role is that you don't have to do that. Have you tried copying a file to the same bucket using the AWS CLI? I'm trying to eliminate things to get to the bottom of this.

0

I'm wondering whether the issue here is with the backslash in the key name (Junk3\junk1.txt) and whether you need to escape that (if you want to use a backslash) or whether it's better to use a forward slash (/). That doesn't explain why it behaves differently on the two EC2 instances though.

profile pictureAWS
エキスパート
回答済み 2年前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ