Unable to update AWS cloud endpoint credentials with the new one
search cancel

Unable to update AWS cloud endpoint credentials with the new one

book

Article ID: 372254

calendar_today

Updated On:

Products

VMware Aria Suite

Issue/Introduction

You have recently updated your AWS Power user account used to connect AWS cloud endpoint in VRA and you hit an error "Failed to validate credentials. Error: Unable to validate credentials in any AWS region!" with the new one

The following status are also reflected in the respective Cloud account.

  • The Data collection failed.
  • Image synchronization failed.
  • Unavailable for deployment. Click Update to run the health check.

You also see below error in /var/log/services-logs/prelude/adapter-host-service-app/file-logs/adapter-host-service-app.log which points to authorization issues 

    com.amazonaws.services.ec2.model.AmazonEC2Exception: You are not authorized to perform this operation. User: arn:aws:iam::XXXXXXXXXX:user/vRA is not authorized to perform: ec2:DescribeAvailabilityZones because no identity-based policy allows the ec2:DescribeAvailabilityZones action (Service: AmazonEC2; Status Code: 403; Error Code: UnauthorizedOperation; Request ID: XXXXXXXXX-XXXXXXX-XX-XX-XXXX; Proxy: proxy-service.prelude.svc.cluster.local)        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1879) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleServiceErrorResponse(AmazonHttpClient.java:1418) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1387) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1157) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:814) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:781) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:755) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:715) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:697) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:561) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:541) ~[aws-java-sdk-core-1.12.261.jar:na]        at com.amazonaws.services.ec2.AmazonEC2Client.doInvoke(AmazonEC2Client.java:34460) ~[aws-java-sdk-ec2-1.12.261.jar:na]        at com.amazonaws.services.ec2.AmazonEC2Client.invoke(AmazonEC2Client.java:34427) ~[aws-java-sdk-ec2-1.12.261.jar:na]        at com.amazonaws.services.ec2.AmazonEC2Client.invoke(AmazonEC2Client.java:34416) ~[aws-java-sdk-ec2-1.12.261.jar:na]        at com.amazonaws.services.ec2.AmazonEC2Client.executeDescribeAvailabilityZones(AmazonEC2Client.java:12911) ~[aws-java-sdk-ec2-1.12.261.jar:na]        at com.amazonaws.services.ec2.AmazonEC2AsyncClient$196.call(AmazonEC2AsyncClient.java:7026) ~[aws-java-sdk-ec2-1.12.261.jar:na]        at com.amazonaws.services.ec2.AmazonEC2AsyncClient$196.call(AmazonEC2AsyncClient.java:7020) ~[aws-java-sdk-ec2-1.12.261.jar:na]        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[na:na]        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[na:na]        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[na:na]        at java.base/java.lang.Thread.run(Thread.java:840) ~[na:na]

 

Environment

Aria Automation 8.x

Aria Automation SAAS

Cause

The AWS Power user account doesn't have the necessary permissions to work

Resolution

To integrate AWS endpoint with VRA we will need certain privileges as minimum. Please review Amazon Web Services (AWS) cloud account credentials and add the missing permissions to the AWS cloud account to make it work with VRA

Once the prerequisites are met you will be able to get the cloud account to successfully sync

Powered by Wolken Software