# Info: ec2\_lb with access\_key/secret\_key specified but could not perform elasticloadbalancing:DescribeLoadBalancers

**URL:** <https://forum.ansible.com/t/info-ec2-lb-with-access-key-secret-key-specified-but-could-not-perform-elasticloadbalancing-describeloadbalancers/16166>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [September 9, 2014, 8:37pm UTC](https://forum.ansible.com/t/info-ec2-lb-with-access-key-secret-key-specified-but-could-not-perform-elasticloadbalancing-describeloadbalancers/16166 "2014-09-09T20:37:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steven\_Truong](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Steven\_Truong](https://forum.ansible.com/u/Steven_Truong)\
**Post date:** [September 9, 2014, 8:37pm UTC](https://forum.ansible.com/t/info-ec2-lb-with-access-key-secret-key-specified-but-could-not-perform-elasticloadbalancing-describeloadbalancers/16166/1 "2014-09-09T20:37:11Z")

</div>

Hi all,

I have a play book that just simply go and add instances to my ELB but apparently the user’s keys specified were not authorized to do the “DescribeLoadBalancers”. This user has a policy attached to it that allows to have full access to this ELB.

Task:

- name: Instance re-register  
local\_action: ec2\_elb ec2\_elbs=steventest region=us-east-1 instance\_id=“{{ ansible\_ec2\_instance\_id }}” state=present wait=yes wait\_timeout=5 aws\_access\_key=A… aws\_secret\_key=…sc enable\_availability\_zone=no

I got this error message.  
User: arn:aws:iam::123456789:user/elb\_dedicated is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers

From AWS doc [http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/UsingIAM.html](http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/UsingIAM.html)

Elastic Load Balancing does not support setting permissions for a user or a group to use the following APIs with a specific load balancer:

- `DescribeInstanceHealth`

- `DescribeLoadBalancerAttributes`

- `DescribeLoadBalancerPolicyTypes`

- `DescribeLoadBalancers`

- `DescribeLoadBalancerPolicies`

- `DescribeTags`

You can continue to use the Describe APIs in the Action element of the policy statement to grant access to all ELB load balancers. However, if you use the Describe APIs in the Action element and also specify a load balancer ARN in the Resource element, the API call will fail.

So ec2\_elb will work when i do not specify the specific ELB in the resource. This is the way AWS implemented access controls for ELBs and Ansible is not at fault here.

Policy attached to AWS user elb\_dedicated and currently, I allowed all actions for this account to this steventest ELB.

{  
“Version”: “2012-10-17”,  
“Statement”: [  
{  
“Sid”: “steventestelb”,  
“Effect”: “Allow”,  
“Action”: [  
“elasticloadbalancing:\*”  
],  
“Resource”: [  
“arn:aws:elasticloadbalancing:us-east-1:123456789:loadbalancer/steventest”  
]  
}  
]  
}

So I removed all “Resource” and the final policy is this:

{  
“Version”: “2012-10-17”,  
“Statement”: [  
{  
“Sid”: “steventestelb”,  
“Effect”: “Allow”,  
“Action”: [  
“elasticloadbalancing:\*”  
]  
}  
]  
}

With this policy, I still got the same error.

failed: [ec2-54-80-…compute-1.amazonaws.com → 127.0.0.1] =\> {“failed”: true, “parsed”: false}  
invalid output was: Traceback (most recent call last):  
File “/home/steven/.ansible/tmp/ansible-tmp-1410294577.11-237620736023803/ec2\_elb”, line 1874, in   
main()  
File “/home/steven/.ansible/tmp/ansible-tmp-1410294577.11-237620736023803/ec2\_elb”, line 317, in main  
region=region, \*\*aws\_connect\_params)  
File “/home/steven/.ansible/tmp/ansible-tmp-1410294577.11-237620736023803/ec2\_elb”, line 123, in **init**  
self.lbs = self.\_get\_instance\_lbs(ec2\_elbs)  
File “/home/steven/.ansible/tmp/ansible-tmp-1410294577.11-237620736023803/ec2\_elb”, line 264, in \_get\_instance\_lbs  
elbs = elb.get\_all\_load\_balancers()  
File “/usr/local/lib/python2.7/dist-packages/boto/ec2/elb/ **init**.py”, line 135, in get\_all\_load\_balancers  
[(‘member’, LoadBalancer)])  
File “/usr/local/lib/python2.7/dist-packages/boto/connection.py”, line 1166, in get\_list  
raise self.ResponseError(response.status, response.reason, body)  
boto.exception.BotoServerError: BotoServerError: 403 Forbidden  
  
  
Sender  
`AccessDenied`  
User: arn:aws:iam::123456789:user/elb\_dedicated is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers  
  
04bd7b0d-3860-11e4-8ac6-5fafa616e3b3

---

<div class="post-metadata">

**Author:** ![Steven\_Truong](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Steven\_Truong](https://forum.ansible.com/u/Steven_Truong)\
**Post date:** [September 9, 2014, 9:35pm UTC](https://forum.ansible.com/t/info-ec2-lb-with-access-key-secret-key-specified-but-could-not-perform-elasticloadbalancing-describeloadbalancers/16166/2 "2014-09-09T21:35:58Z")

</div>

A new interesting development. I remove aws\_access\_key and aws\_secret\_key from the task ec2\_elb and create ~/.boto and tried again. This type things work.

[Credentials]  
aws\_access\_key\_id=…  
aws\_secret\_access\_key=…

Hmmm…