Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to use Eric Hammond's ec2-consistent-snapshot utility on a dedicated mysql server.

I've created an IAM user and attached a power user permission policy (using the AWS console).

On a 32bit Ubuntu 10.10 ec2 instance and an XFS volume, I have installed ec2-consistent-snapshot following these instructions : http://alestic.com/mt/mt-search.cgi?blog_id=1&tag=ec2-consistent-snapshot&limit=20.

The command I launch is the following :

ec2-consistent-snapshot \ 
    --freeze-filesystem /data03 \
    --description "Test description $(date +'%Y-%m-%d %H:%M:%S')"  \
    --mysql \
    --mysql-user <my user>  \
    --mysql-host 127.0.0.1 \
    --mysql-socket /var/run/mysqld/mysqld.sock \
    --debug \
    vol-11111111

And the debug output is :

ec2-consistent-snapshot: Using AWS access key: AWSAccessKeyId=AKI[...]
ec2-consistent-snapshot: Thu Mar 22 10:28:53 2012: MySQL connect as <my user>
ec2-consistent-snapshot: Thu Mar 22 10:28:53 2012: MySQL flush
ec2-consistent-snapshot: Thu Mar 22 10:28:53 2012: MySQL flush & lock
ec2-consistent-snapshot: master_log_file="mysql-bin.000726", master_log_pos=106
ec2-consistent-snapshot: Thu Mar 22 10:28:53 2012: sync
ec2-consistent-snapshot: Thu Mar 22 10:28:53 2012: xfs_freeze -f /data03
ec2-consistent-snapshot: Thu Mar 22 10:28:54 2012: create EC2 object
ec2-consistent-snapshot: Thu Mar 22 10:28:54 2012: ec2-create-snapshot vol-11111111
ec2-consistent-snapshot: ERROR: AWS was not able to validate the provided access credentials
ec2-consistent-snapshot: Thu Mar 22 10:28:56 2012: xfs_freeze -u /data03
ec2-consistent-snapshot: Thu Mar 22 10:28:56 2012: MySQL unlock
ec2-consistent-snapshot: Thu Mar 22 10:28:56 2012: MySQL disconnect
ec2-consistent-snapshot: Thu Mar 22 10:28:56 2012: done

(Of course, volume id is not actually 111111111).

I tried modifying the code to be sure it was using the correct secret key, which turned out to be the right one.

I also have an evironment variable that points to /root/.awssecret

echo $AWS_CREDENTIAL_FILE
/root/.awssecret

Other things I've tried, and have produced the same results : -Passing the credential file's path as a paramater. -Generating new credentials and using those. -Specifying the region as us-east-1 rather than letting it go to default.

Here is what my credentials file LOOKS like :

AWSAccessKeyId=AKI[...]
AWSSecretKey=DPh[..]

That's pretty much it, thanks for any help.

share|improve this question
1  
Quick guess - the debug output usually reads 'Using AWS access key: AKI[...]'; and a quick glance at the code suggests that you could try leaving off the 'AWSAccessKeyId=' and 'AWSSecretKey=' prefixes in your credentials file. As per the script's documentation, the file should contain the Amazon AWS access key and secret access key on seprate lines and in that order, and reads the $AWS_CREDENTIALS environment variable. –  cyberx86 Mar 22 '12 at 15:42
    
That was exactly it. What had confused me seems to be the documentation here : alestic.com/mt/… . At some point he speeks about the file format and the AWS credentials were prefixed the way I had it here. Thanks, you should put this in form of an answer so I can accept it. –  IanBussieres Mar 22 '12 at 17:25
add comment

1 Answer

up vote 2 down vote accepted

The debug output of ec2-consistent-snapshot usually reads:

'Using AWS access key: AKI[...]'

Since the output you are shown includes AWSAccessKeyId= and after a quick glance at the code (lines 470-471) - which simply reads in each line, with no further parsing:

($aws_access_key_id, $aws_secret_access_key) =
      File::Slurp::read_file($aws_credentials_file);

The solution is likely to leave off the 'AWSAccessKeyId=' and 'AWSSecretKey=' prefixes in your credentials file. Your credentials file should, therefore, resemble:

AKI[...]
DPh[...]

As per the script's documentation, the file should contain the Amazon AWS access key and secret access key on seprate lines and in that order. Additionally, the script reads the $AWS_CREDENTIALS environment variable.

You could also try to pass the authentication parameters directly to the script, using the --aws-access-key-id and --aws-secret-access-key parameters.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.