# Problem with the ec2\_tag module

**URL:** <https://forum.ansible.com/t/problem-with-the-ec2-tag-module/14923>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [April 2, 2014, 5:51pm UTC](https://forum.ansible.com/t/problem-with-the-ec2-tag-module/14923 "2014-04-02T17:51:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stephen\_Gargan](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@Stephen\_Gargan](https://forum.ansible.com/u/Stephen_Gargan)\
**Post date:** [April 2, 2014, 5:51pm UTC](https://forum.ansible.com/t/problem-with-the-ec2-tag-module/14923/1 "2014-04-02T17:51:44Z")

</div>

I’m having trouble with boto and the ec2\_tags module I’m hoping someone will know what is up.

I’m spinning up an ec2 instance and then immediately calling the ec2\_facts and ec2\_tags to grab data to  
configure the instance. The creation and ec2\_facts work without a problem, but the ec2\_tags fails with

msg: No handler was ready to authenticate. 1 handlers were checked. [‘QuerySignatureV2AuthHandler’] Check your credentials

which is the typical error when the the AWS\_ACCESS\_KEY\_ID and AWS\_SECRET\_ACCESS\_KEY are not set; clearly  
they are as the previous 2 calls (and the ec2 inventory plugin) are using them.

the tags command boils down to the following

ec2\_tag resource=‘arn:aws:ec2:us-west-2:7XXXXXXXXX:instance/i-abcabcab’ region=us-west-2 state=list tags=

I’m using boto 2.27

Anyone know what is up here or what I can do to fix it?

thanks

Steve.

---

<div class="post-metadata">

**Author:** ![C\_S](https://avatars.discourse-cdn.com/v4/letter/c/ea5d25/32.png) [@C\_S](https://forum.ansible.com/u/C_S)\
**Post date:** [April 2, 2014, 7:24pm UTC](https://forum.ansible.com/t/problem-with-the-ec2-tag-module/14923/2 "2014-04-02T19:24:09Z")

</div>

Try having the module run locally on an instance that is in an IAM role that has perms to update the tags on other instances. Boto should then get the credentials automatically from the metadata.

That’s been working well for us.

---

<div class="post-metadata">

**Author:** ![Stephen\_Gargan](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@Stephen\_Gargan](https://forum.ansible.com/u/Stephen_Gargan)\
**Post date:** [April 2, 2014, 11:36pm UTC](https://forum.ansible.com/t/problem-with-the-ec2-tag-module/14923/3 "2014-04-02T23:36:27Z")

</div>

Thanks for the reply, the instance is created with an iam profile with very open permissions and its on this instance that the ec2\_tag module is running. If I look at the metadata on the host i do see credentials for the profile

curl [http://169.254.169.254/latest/meta-data/iam/security-credentials/tagging/](http://169.254.169.254/latest/meta-data/iam/security-credentials/tagging/)  
{  
“Code” : “Success”,  
“LastUpdated” : “2014-04-02T22:13:03Z”,  
“Type” : “AWS-HMAC”,  
“AccessKeyId” : “ASIAIJZA6QAITICEXXXX”,  
“SecretAccessKey” : “fdXki1+UXXXgQNt89G3Impl5vnU1IlRMkXXXX”,  
“Token” : “AQoDYXdz…”,  
“Expiration” : “2014-04-03T04:43:59Z”  
}

Though I’m not too sure if this enough as its still complaining. I’ve tried a number of combinations of permissions but no joy this far. If its not too sensitive, would you mind sharing what your tagging profile looks like? Cheers for your help I really appreciate it.

Thanks,

Steve.