Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Cannot accept RAM invitation in another account: Association failed because the caller was not authorized.

0

I am trying to share an EC2 Placement Group from one account to another using Resource Access Manager. These two accounts are independent -- not part of an AWS Organization.

From the owner account, I create a CfnResourceShare. This part works. The owner account has a resource share for the placement group. It shows the receiving account in pending status.

In the receiving account I can see the invitation. I call ram:AcceptResourceShareInvitation, and I get a 200 OK response, with response body showing status ACCEPTED. Great!

Now things go off the rails. In the receiving account, the placement group does not exist. RAM GetResourceShares operation returns no items. RAM GetResourceShareInvitations returns the original invitation, with status ACCEPTED. Hmm!

Meanwhile in the owner account, the resource invitation shows status "Failed" for the receiving account, with message "Association failed because the caller was not authorized." I don't know how to proceed here.

I found troubleshooting for the same symptoms in AWS Lake Formation, but the solution presented there doesn't make sense to me. The IAM policy of the invitation acceptor doesn't seem to matter - even an Administrator gets the same symptoms.

Any ideas how to allow cross-account RAM sharing of a Placement Group?

Topics
Security, Identity, & Compliance
Tags
AWS Identity and Access ManagementAWS Resource Access Manager
Language
English

asked 10 months ago372 views

1 Answer
0

The issue you're experiencing with RAM sharing of an EC2 Placement Group between independent accounts appears to be related to missing permissions in the receiving account.

When accepting a resource share invitation, AWS RAM needs to perform certain actions behind the scenes. Based on the error "Association failed because the caller was not authorized," it suggests that even though the invitation was accepted (status shows ACCEPTED), the actual association of the resource failed due to permission issues.

For EC2 resources like Placement Groups, the receiving account likely needs permissions to interact with the EC2 service to complete the association. Here are some steps to troubleshoot and resolve this issue:

  1. Ensure the IAM role or user in the receiving account that's accepting the invitation has sufficient permissions. Even though you mentioned using an Administrator, verify that there are no restrictions from any IAM policies that might be limiting EC2-related actions.

  2. Check if there are any resource-based policies in the receiving account that might be restricting the association.

  3. Try the following approach to resolve the issue:

  • In the receiving account, ensure the IAM entity accepting the invitation has explicit permissions for relevant EC2 actions related to placement groups.
  • You may need to add permissions like ec2:DescribePlacementGroups and other related EC2 actions.
  1. If the issue persists, you might need to check for any service-specific requirements for sharing EC2 Placement Groups across accounts that are not part of an organization.

The error "Association failed because the caller was not authorized" typically indicates that while the initial acceptance of the invitation succeeded, the subsequent steps to associate the resource with the receiving account failed due to permission issues. Ensuring proper EC2-related permissions in the receiving account should help resolve this issue.
Sources
Troubleshooting Lake Formation - AWS Lake Formation
How do I troubleshoot when User: arn is no authorized to perform Create * or Delete * or Update * on resource(s) because no identity- policy allows the actions | AWS re:Post

answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content