I have an IAM role for EC2 instance (so called Instance Profile) with two policies attached, giving full access to SQS and S3. There is an EC2 instance running associated with this role. It runs several apps, that do use temporary credentials and everything is working fine.

Right now, one of my apps needs also access to SNS. I've modified IAM role, adding an Inline policy with policy generator, allowing certain API calls for particular SNS topic. However after modification of IAM role, when trying aws sns list-topics I get following error (respective arn's replaced with triple X):

User: XXX is not authorized to perform: SNS:ListTopics on resource: XXX:*

Does the addition of policy require instance to be restarted? Or do I have to wait for the temporary credentials (/latest/meta-data/iam/security-credentials/iam-role-name) to expire? Can I somehow force expiration of those credentials?

EDIT: The last question seems to be answered by IAM FAQ. Temporary credentials can't be reactivated or extended.

  • The FAQ also implies that what you're doing should work: You can change the permissions on the IAM role associated with a running instance, and the updated permissions will take effect almost immediately. This (if true) contradicts an assumption I've been making that there was policy information embedded (and signed and encrypted) in the security token (otherwise, it's not clear why the token is needed). If, when the temporary credentials expire, you can then access SNS, that will be interesting to know. If not, that's potentially informative, as well. Wish I could offer more. – Michael - sqlbot Jun 25 '15 at 0:16
  • Out of curiosity, I just stopped and started an instance with an IAM role, without changing anything about the permissions associated with the role, to see what would happen to the temporary creds. Before the reboot, my temporary credentials were not due to expire for several hours, and yet, after the reboot, they were completely reissued, with a new key, secret, token, and expiration time. – Michael - sqlbot Jun 25 '15 at 0:29

After many different approaches, it turned out that limiting my policy for a single queue was causing all the problems. I assumed that when policy applies to single queue and you do ListTopics, then you will get just the topic you have access to. However, my SNS had several other topics and most probably their existence in ListTopics result was considered a violation of policy. When I replaced particular topic name with '*' and saved the policy, then immidiatelly (no need for expiration of credentials or EC2 instance restarts) it started working.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.