Getting authentication error while running python code.

Question

Hello Experts,

This is regarding my boto3 python code which I am running to get basically all my ec2 instances, created by me. Problem is it's giving Authentication error in Lambda aws.

Tried efforts: I have put my user's access id and access security key on program it's not working. Then I created 1 policy added all permissions to ec2 there and attach to user but then also same error.

**Error message:**  In lambda code execution.

```
{
  "errorMessage": "An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.",
  "errorType": "ClientError",
  "requestId": "",
  "stackTrace": [
    "  File "/var/lang/lib/python3.10/importlib/__init__.py", line 126, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
",
    "  File "", line 1050, in _gcd_import
",
    "  File "", line 1027, in _find_and_load
",
    "  File "", line 1006, in _find_and_load_unlocked
",
    "  File "", line 688, in _load_unlocked
",
    "  File "", line 883, in exec_module
",
    "  File "", line 241, in _call_with_frames_removed
",
    "  File "/var/task/lambda_function.py", line 29, in 
    instances= ec2.meta.client.describe_instances()
",
    "  File "/var/runtime/botocore/client.py", line 530, in _api_call
    return self._make_api_call(operation_name, kwargs)
",
    "  File "/var/runtime/botocore/client.py", line 960, in _make_api_call
    raise error_class(parsed_response, operation_name)
"
  ]
}
```

**Boto3 lambda code:**

```
import boto3 
import os
regions= [
    #'ap-east-1',
    'ap-northeast-1',
    'ap-northeast-2',
    'ap-south-1',
    'ap-southeast-1',
    'ap-southeast-2',
    'ca-central-1',
    'eu-central-1',
    'eu-north-1',
    'eu-west-1',
    'eu-west-2',
    'eu-west-3',
    #'me-south-1',
    'sa-east-1',
    'us-east-1',
    'us-east-2',
    'us-west-1',
    'us-west-2'
    ]
# os.environ['AWS_ACCESS_KEY_ID'] = 'key id here'
# os.environ['AWS_SECRET_ACCESS_KEY'] = 'access key here'

for region_name in regions:
    # print(f'region_name: {region_name}')
    ec2= boto3.resource('ec2', region_name=region_name)
    instances= ec2.meta.client.describe_instances()
    for instance in instances['Reservations']:
        id = instance['Instances'][0]['InstanceId']
        if(id):
           instance_state = instance['Instances'][0]['State']['Name']
           print("Instance id of region " + str(region_name) + " is:" + str(id) + ", its state is: " + str(instance_state))
```

Policy Name: ![Enter image description here](/media/postImages/original/IMAZEiiBKbRXmnZEgB3kc24A)

How Policy looks:
![Enter image description here](/media/postImages/original/IM2PWK0KZ2Tc-_aL96YiMppA)

Your guidance is really appreciated 🙏

Accepted Answer

For Lamba, you want to use a role and not a user. Lambda always has an "execution role", which is assumed when the function is executed.

Given that you have a Lambda function already, an execution role is most probably already present. What you need to do now is:

* Find the execution role, in the settings of your Lambda function
* Attach the policy you have created

As Nitin has stated already, there's no need to hard-code credentials within your function, since Lambda will request temporary credentials via STS automatically (the key here is "trust policies", the execution role contains a trust policy which allows Lambda to assume this role).

If this still doesn't work, please consult the CloudWatch logs for your Lambda function. They might contain useful information about the root cause of any potential additional issue.

Answer

Hi - It would be great to share the policy and also error messages.

Couple of things
1. You don't have to hard code your credentials and use roles . See Lambda execution role
 (https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html) 
2. The roles should have required policy for the actions
3. I would say , see lambda functions logs in cloudwatch for more detailed error message. Reference https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs.html

Getting authentication error while running python code.

Relevant content