hello,

for myself I made a bit more constrained policy

{


    "Version": "2012-10-17",


    "Statement": [


        {


            "Sid": "AllowParticularRegionEC2",


            "Effect": "Allow",


            "Action": [


                "<all listed ec2 permissions from above>"


            ],


            "Resource": "*",


            "Condition": {


                "StringEquals": {


                    "aws:RequestedRegion": [


                        "eu-west-1"


                    ]


                }


            }


        },


        {


            "Sid": "AllowParticularIamEntities",


            "Effect": "Allow",


            "Action": [


                "<all listed iam permissions"


            ],


            "Resource": [


                "arn:aws:iam::<account id>:instance-profile/aviatrix-*",


                "arn:aws:iam::<account id>:role/aviatrix-*",


                "arn:aws:iam::<account id>:policy/aviatrix-*"


            ]


        },


        {


            "Effect": "Allow",


            "Action": [


                "sts:GetCallerIdentity"


            ],


            "Resource": "*"


        }


    ]


}

vjacheslav Appreciate the feedback! I've validated your suggestions and have updated the post to include your recommendation.

When you are using Chrome/Edge, the 'Copy' button will generate some invisible Unicode characters which will screw up the policy.

Workaround: Select the text manually and copy manually.

How do I get around this error? Can someone please help? I removed all the unicode chars that generated errors but I ran into this one once I corrected the policy document.

Appreciate the help…

I figured out the issue. I think the document or instruction in this portal should be updated for a virgin set up or user and indicate that the policy needed to be created first (AWS: policy → create policy→ attach to user). The instruction does not show this, rather it gives the impression that you simply have to edit an existing one. This maybe true for some cases but for folks who just came into this training this needs to be clearly spelled out in the instructions. If this issue I ran into helps someone in the ACE community I hope I eased someone’s struggles !… 

To the ACE leadership, take this as suggestion to update your document .

My two cents :)….

I had to add two actions to above policy to fix errors in SST 1.4.2:

"ec2:DescribeReservedInstancesOfferings" to fix:
error reading EC2 Instance Type Offerings: UnauthorizedOperation: You are not authorized to perform this operation. │ status code: 403, request id: 5419e4b5-e474-4cbb-9408-8de9724e2342 │ │ with module.aviatrix_controller_aws.module.aviatrix_controller_build.data.aws_ec2_instance_type_offering.offeringo"us-east-1a"], │ on .terraform/modules/aviatrix_controller_aws/modules/aviatrix-controller-build/variables.tf line 117, in data "aws_ec2_instance_type_offering" "offering": │ 117: data "aws_ec2_instance_type_offering" "offering" { │ ╵ ╷ │

"ec2:AssociateRouteTable" to fix:
error creating route table: UnauthorizedOperation: You are not authorized to perform this operation. Encoded authorization failure message: PZbfG6kiWVHlbpq6RRmeKcjj94M7JNZyCgCortganUlz3immTYP4gif8ln_o7RooYITmG5lAlaoyIwVSSoO_At0rjyQdCXEhJJ0If_IyrPidAgtgw7_dB3wUEf3r2uP0cf1_MiCePDcn2elrjXXInGdZpGaVifmE4ECzKHrwHYdueLmRjqaT4t1tYZtYzYVWUv1g0EnwnwbSTRfo0luYWK70IrT1gUmeVVrlTOQBAoBQ1fQCNReXQh6cX22XtyoIMXRM4P6Jb3AC7uOzh_iJ2kGTwt1UsQFrJJa_QeRoysZDqAfBINtQVLvY_genKC5l13iCi5f4nxMxQUxc0hXt6E1Ux9H2ok2CPcyuuS9WK3Dftfy7opSKV_k9DKrL7u0b14JcJqqPyj9G_AkyaCcYryt096Ewr8aBRnvAvPtXYLW1Ya8CVNlBPGoyVv1fMcxdXXYId1f44_P-0nMskh17jhD_g4-4JMHQvNvF5UoLD_Tv104AKI1cbbiUZ6SC1P85_khJcTRtaAK4mCPGoeZF7HFcBOXtd3To1xYqA13KKkmL6GWkdRV4u6ErjFhgHDIFGgrpqf-RBXPS-ynggamaN38pqx4t-WffXg │ status code: 403, request id: 645d9983-6890-4ebf-b870-c631eecb9111 │ │ with module.aviatrix_controller_aws.module.aviatrix_controller_build.aws_route_table.publicu0], │ on .terraform/modules/aviatrix_controller_aws/modules/aviatrix-controller-build/main.tf line 21, in resource "aws_route_table" "public": │ 21: resource "aws_route_table" "public" { │ ╵ --> Controller launch failed, aborting.

I also had to add additional actions to the policy:

ec2:DescribeInstanceTypeOfferings

ec2:CreateRouteTable

ec2:AssociateRouteTable

ec2:DescribeSecurityGroupRules

I did not have to add ec2:DescribeReservedInstancesOfferings at any point during the labs.

I did not have to add ec2:DescribeSecurityGroupRules to run the SST, but since the AWS Access Key is used later in Terraform, I had to add it later to reapply failed changes after correcting them.

I did not face that much issues with the policy code creation.

Turns out some few steps has to be done before inserting the poly code.

For me,

1. When to IAM center “policy - create new policy”
2. Added the the policy code
3. Edited the policy code at the bottom with account_ID ( I removed the “< >”, if not the code would not be validated)
4. Validated the creation.
5. I created a group and attached the permission to it
6. Then i created a user and add it to the group.