# AWS China Support/Issues - AWS was not able to validate the provided access credentials - Launching Instance **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu, aws\ **Created:** [October 19, 2015, 10:58pm UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556 "2015-10-19T22:58:00Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![K\_Cheng](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@K\_Cheng](https://forum.ansible.com/u/K_Cheng)\ **Post date:** [October 19, 2015, 10:58pm UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/1 "2015-10-19T22:58:00Z")
Hi, Apologies if this has already been asked previously - I couldn’t seem to find the relevant information I required. I’m having issues running a playbook to launch a EC2 instance in AWS China. The same playbook works in non-China AWS accounts. The error I am receiving is the following: > TASK [Launch instance] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > ESTABLISH LOCAL CONNECTION FOR USER: ubuntu > > 127.0.0.1 EXEC () > > 127.0.0.1 PUT > > 127.0.0.1 EXEC LANG=C LC\_MESSAGES=C LC\_CTYPE=C \> /dev/null 2\>&1 > > An exception occurred during task execution. The full traceback is: > > Traceback (most recent call last): > > File “/Users/Etherdaemon/.ansible/tmp/ansible-tmp-1445294739.44-143915179278919/ec2”, line 3429, in > > main() > > File “/Users/Etherdaemon/.ansible/tmp/ansible-tmp-1445294739.44-143915179278919/ec2”, line 1392, in main > > (tagged\_instances, instance\_dict\_array, new\_instance\_ids, changed) = enforce\_count(module, ec2, vpc) > > File “/Users/Etherdaemon/.ansible/tmp/ansible-tmp-1445294739.44-143915179278919/ec2”, line 771, in enforce\_count > > reservations, instances = find\_running\_instances\_by\_count\_tag(module, ec2, count\_tag, zone) > > File “/Users/Etherdaemon/.ansible/tmp/ansible-tmp-1445294739.44-143915179278919/ec2”, line 558, in find\_running\_instances\_by\_count\_tag > > reservations = get\_reservations(module, ec2, tags=count\_tag, state=“running”, zone=zone) > > File “/Users/Etherdaemon/.ansible/tmp/ansible-tmp-1445294739.44-143915179278919/ec2”, line 617, in get\_reservations > > results = ec2.get\_all\_instances(filters=filters) > > File “/usr/local/lib/python2.7/site-packages/boto/ec2/connection.py”, line 585, in get\_all\_instances > > max\_results=max\_results) > > File “/usr/local/lib/python2.7/site-packages/boto/ec2/connection.py”, line 681, in get\_all\_reservations > > [(‘item’, Reservation)], verb=‘POST’) > > File “/usr/local/lib/python2.7/site-packages/boto/connection.py”, line 1186, in get\_list > > raise self.ResponseError(response.status, response.reason, body) > > boto.exception.EC2ResponseError: EC2ResponseError: 401 Unauthorized > > \ > > `AuthFailure`AWS was not able to validate the provided access credentials88e083e5-bdcf-4bf0-95ba-740ceb5ec790 > > fatal: [localhost]: FAILED! =\> {“changed”: false, “failed”: true, “parsed”: false} My playbook looks like this: > * * * > > - name: Create an All In One Environment > > hosts: localhost > > vars\_files: > > - “…/variable\_files/{{ env }}\_vars.yml” > > gather\_facts: False > > tags: > > - create > > tasks: > > - include: tasks/iam.yml > > - name: Launch instance > > ec2: > > key\_name: “{{ key\_name }}” > > group: “{{ security\_group }}” > > instance\_type: “{{ instance\_type }}” > > image: “{{ image }}” > > wait: true > > region: “{{ region }}” > > vpc\_subnet\_id: “{{ subnet\_id }}” > > assign\_public\_ip: no > > instance\_tags: > > Name: “{{ role }}{{ ‘%02d’|format(instance\_count|int) }}.{{ env }}.aws-{{ region\_shortname }}.{{ tld\_name\_internal }}” > > Environment: “{{ environment\_name }}” > > Role: “{{ role }}” > > exact\_count: “{{ instance\_count }}” > > count\_tag: > > Environment: “{{ environment\_name }}” > > Role: “{{ role }}” > > instance\_profile\_name: “{{ game }}\_{{ env }}\_ec2\_role” > > volumes: > > - device\_name: /dev/xvdb > > ephemeral: ephemeral0 > > - device\_name: /dev/xvdc > > ephemeral: ephemeral1 > > user\_data: “{{ lookup(‘file’, ‘files/userdata.txt’) }}” > > register: ec2 > > - name: Add new instance to host group > > add\_host: hostname={{ item.public\_ip }} groupname=“{{ environment\_name }}” > > with\_items: ec2.instances > > - name: Wait for SSH to come up > > wait\_for: host={{ item.public\_dns\_name }} port=22 delay=60 timeout=320 state=started > > with\_items: ec2.instances - I am running Ansible from source - v2.0.0-0.3.beta1 - I am also running boto (2.38.0) and boto3 (1.1.4) - I am using /.boto config with a profile named china - If I run the ec2.py inventory script by itself using the boto profile and credentials it runs correctly with no errors - If I run from a local inventory instead - the same error occurs - I have checked my IAM credentials and it has full access - I suspect the issue is around boto using the get\_all\_instances command Can anyone advise if they have Ansible running in AWS China atm or if anyone has an idea on what the issue is? Any help greatly appreciated. Cheers Karen ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [October 19, 2015, 11:34pm UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/2 "2015-10-19T23:34:06Z")
Only accounts created in the China region can access the China region [https://www.amazonaws.cn/en/sign-up/](https://www.amazonaws.cn/en/sign-up/), this is an AWS restriction and Ansible cannot do anything about it. ---
**Author:** ![K\_Cheng](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@K\_Cheng](https://forum.ansible.com/u/K_Cheng)\ **Post date:** [October 19, 2015, 11:43pm UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/3 "2015-10-19T23:43:38Z")
I have an AWS China account with IAM credentials which is what I am trying to use with Ansible. I’ve found a handful of github Ansible/China related issues/posts but I can’t tell whether Ansible supports China or not. Karen ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [October 19, 2015, 11:45pm UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/4 "2015-10-19T23:45:11Z")
Ansible does not restrict the regions, that is what your credentials + AWS API do, are you sure you are using the correct credentials? The error message you got seems to indicate that this is not the case. ---
**Author:** ![K\_Cheng](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@K\_Cheng](https://forum.ansible.com/u/K_Cheng)\ **Post date:** [October 19, 2015, 11:52pm UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/5 "2015-10-19T23:52:47Z")
Yes - only thing that is different is that China and some other regions AWS has supports only Signature v4 while other AWS regions support both v2 and v4 Signatures so not sure if that has been catered for. In terms of credentials - yes they are correct - they work for both the ec2.py dynamic inventory script, terraform scripts, etc. I even created a second set of API keys and tried those as well. Karen ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [October 20, 2015, 12:02am UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/6 "2015-10-20T00:02:14Z")
So they should work 'in principle' I know other people have been using the China region, not sure about the signatures though, is that a recent change? ---
**Author:** ![K\_Cheng](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@K\_Cheng](https://forum.ansible.com/u/K_Cheng)\ **Post date:** [October 20, 2015, 12:08am UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/7 "2015-10-20T00:08:27Z")
Thanks Brian, in terms of the Signature - its been there from day 1 from memory. In terms of getting help on this issue, would this be the best place to ask for help on this matter? Not sure how to proceed and AWS China is something we need to have working. I was working on terraform originally but wasn’t liking the way the variables and structure was going so thought I would take a look at Ansible instead. I would really prefer to stick with Ansible as I like what I’ve seen so far. Karen ---
**Author:** ![K\_Cheng](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@K\_Cheng](https://forum.ansible.com/u/K_Cheng)\ **Post date:** [October 20, 2015, 12:46am UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/8 "2015-10-20T00:46:06Z")
Hmm - looks like its something to do with the profile lookup in boto. I’ve hardcoded the credentials into the playbook temporarily to test and launching of an instance now works - creating an IAM role does not at the moment and returns: The security token included in the request is invalid." ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [October 20, 2015, 12:57am UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/9 "2015-10-20T00:57:14Z")
Open a github issue, we might be able to work around this, afaik those using AWS in the China zone were using 1.x versions of ansible, there were many changes introduced in 2.0 (current devel). ---
**Author:** ![K\_Cheng](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@K\_Cheng](https://forum.ansible.com/u/K_Cheng)\ **Post date:** [October 20, 2015, 12:59am UTC](https://forum.ansible.com/t/aws-china-support-issues-aws-was-not-able-to-validate-the-provided-access-credentials-launching-instance/19556/10 "2015-10-20T00:59:46Z")
No worries - thanks Brian.