AWS: instance metadata for iam is not found

Question

I'm trying to set up elasticsearch s3 snapshots on my ec2 instances. And it fails with following error:

nested: NotSerializableExceptionWrapper[sdk_client_exception: The requested metadata is not found at http://169.254.169.254/latest/meta-data/iam/security-credentials/

If I query the metadata server from that ec2 instance, it responses the following:

$ curl http://169.254.169.254/latest/meta-data/
ami-id
ami-launch-index
ami-manifest-path
block-device-mapping/
events/
hostname
identity-credentials/
instance-action
instance-id
instance-type
local-hostname
local-ipv4
mac
metrics/
network/
placement/
profile
public-keys/
reservation-id
security-groups
services/

So there is no iam section.

How to make iam section available for querying from ec2 instance ?

Answer 1

Following meta-data URI will return something if you have the role attached to the given ec2 instance:

http://169.254.169.254/latest/meta-data/iam/security-credentials/

so it looks like you don't have an IAM role attached. Please verify.

Answer 2

I had this problem yesterday. My automation created a instance profile but it does not have assume role.

{
    "InstanceProfile": {
        "Path": "/",
        "InstanceProfileName": "example_instance_profile",
        "InstanceProfileId": "<id>",
        "Arn": "<arn>",
        "CreateDate": "«date_time>",
        "Roles": []
    }
}

I deleted this instance profile and created again with automation.

{
    "InstanceProfile": {
        "Path": "/",
        "InstanceProfileName": "<profile_name>",
        "InstanceProfileId": "<profile_id>",
        "Arn": "<arn>",
        "CreateDate": "«date_time>",
        "Roles": [
            {
                "Path": "/",
                "RoleName": "<role_name>",
                "RoleId": "<role_id>",
                "Arn": "<arn>",
                "CreateDate": "<date>",
                "AssumeRolePolicyDocument": {
                    "Version": "<date>",
                    "Statement": [
                        {
                            "Sid": "",
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "ec2.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                }
            }
        ]
    }
}