Aws-parallelcluster: Issues with pcluster configure

[afernandezody]

Hello Awsparallelcluster Team,
I've added a second account (to my usual account) in order to spin up separate clusters. However, and after inputting the Access Key ID & AWS Secret Access Key via aws configure, the configuration is failing with:

pcluster configure
WARNING: Configuration file C:\Users\.parallelcluster\config will be overwritten. Press CTRL-C to interrupt the procedure.
Failed with error: An error occurred (UnauthorizedOperation) when calling the DescribeRegions operation: You are not authorized to perform this operation.
Hint: please check your AWS credentials.
Run `aws configure` or set the credentials as environment variables.

It seems to be that I need to provide some extra permissions and guessing it's in the IAM page but browsing, for example, roles and policies show a lot of differences between the accounts. The bottom line is that I'm going to need a bit of help on which permissions pcluster configure needs.
Thanks.

[demartinofra]

Hi,

I think this specific error can be resolved by adding ec2:DescribeRegions policy.

Here is where you can find a complete list of required policies: https://docs.aws.amazon.com/parallelcluster/latest/ug/iam.html#parallelclusteruserpolicy

[afernandezody]

Hi @demartinofra,
Thanks for the quick reply. I didn't find the policy that you mention associated with my main account and couldn't create it in the second one. As a matter of fact, I noticed that CloudFormation is among the services included in policy creation but not Awsparallelcluster (not sure if this might be worth updating). The whole thing requires a little bit more digging than anticipated, and I'll come back to it on Friday.

[demartinofra]

You should check what is the IAM role associated to the credentials you set in your cli (aws configure), and make sure that the policy associated to that user includes the access to ec2:DescribeRegions and additionally the permissions listed here.

Let us know if you need any further guidance on this and we'll be happy to help.

[afernandezody]

Hi @demartinofra,
It seems like I tripped myself while switching from using a root in my primary account (which I probably shouldn't have been using in the first place) to an user account in the new account. I restarted from scratch and it's now working. Still haven't tried using an IAM role to deploy a cluster but it's in my list of things to learn.
I'm closing the ticket (will reopen only if some other issue comes up). Thank you so much.