Sometimes Amazon EC2 users report to us that while trying to launch an Amazon Elastic Compute Cloud (Amazon EC2) instance they end up with the error "An error occurred (UnauthorizedOperation)" .

Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers to perform related Amazon EC2 queries.

In this context, we shall look into how to fix this aws error.

Nature of EC2 "UnauthorizedOperation" Error 

When this error happens, you will see an error message such as this:

Launch Failed - You are not authorized to perform this operation. Encoded authorization failure message.

Basically, the "UnauthorizedOperation" error occurs when the user or role tries to perform the operation that doesn’t have permission to describe (or list) EC2 instances.

Tips to fix EC2 "UnauthorizedOperation" Error 

1. Firstly we need to verify that the AWS CLI is installed and configured on our machine using the following command:

$ aws --version

Note: We must ensure to use the most recent version of the AWS CLI.

2.  After that we can run the decode-authorization-message command as given below:

$ aws sts decode-authorization-message --encoded-message encoded-message

Note: Here we must replace the encoded-message with the exact encoded message we got in the error message.

3. Now the decoded message lists the required permissions that are missing from the IAM role or user policy.

The Following is an example of an encoded message:

Launch Failed - You are not authorized to perform this operation. Encoded authorization failure message: 4GIOHlTkIaWHQD0Q0m6XSnuUMCm-abcdefghijklmn-abcdefghijklmn-abcdefghijklmn

OR

$ aws sts decode-authorization-message --encoded-message 4GIOHlTkIaWHQD0Q0m6XSnuUMCm-abcdefghijklmn-abcdefghijklmn-abcdefghijklmn
{
    "DecodedMessage": 
"{\"allowed\":false,\"explicitDeny\":false,\"matchedStatements\":{\"items\":[]},\"failures\":{\"items\":[]},\"context\":{\"principal\":{\"id\":\"ABCDEFGHIJKLMNO\",\"name\":\"AWS-User\",
\"arn\":\"arn:aws:iam::accountID:user/test-user\"},\"action\":\"iam:PassRole\",
\"resource\":\"arn:aws:iam::accountID:role/EC2_instance_Profile_role\",\"conditions\":{\"items\":[{\"key\":\"aws:Region\",\"values\":{\"items\":[{\"value\":\"us-east-2\"}]}},
{\"key\":\"aws:Service\",\"values\":{\"items\":[{\"value\":\"ec2\"}]}},{\"key\":\"aws:Resource\",\"values\":{\"items\":[{\"value\":\"role/EC2_instance_Profile_role\"}]}},
{\"key\":\"iam:RoleName\",\"values\":{\"items\":[{\"value\":\"EC2_instance_Profile_role\"}]}},{\"key\":\"aws:Account\",\"values\":{\"items\":[{\"value\":\"accountID\"}]}},
{\"key\":\"aws:Type\",\"values\":{\"items\":[{\"value\":\"role\"}]}},{\"key\":\"aws:ARN\",\"values\":{\"items\":[{\"value\":\"arn:aws:iam::accountID:role/EC2_instance_Profile_role\"}]}}]}}}"
}

From the above message we can infer that the request failed to call RunInstances as AWS-User does not have permission to perform the iam:PassRole action on the arn:aws:iam::accountID:role/EC2_instance_Profile_role.

4.  Finally, we have to edit the IAM policy associated with the IAM role or user to add the missing permissions.

[Need assistance in fixing Aws errors? We can help you. ]