# AWS IAM role not working with Elasticsearch 5.0.0-alpha2, but works with 2.3 version **URL:** \ **Category:** Elasticsearch\ **Created:** [May 30, 2016, 6:58pm UTC](https://discuss.elastic.co/t/aws-iam-role-not-working-with-elasticsearch-5-0-0-alpha2-but-works-with-2-3-version/51347 "2016-05-30T18:58:05Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![randhirkr](https://avatars.discourse-cdn.com/v4/letter/r/9dc877/32.png) [@randhirkr](https://discuss.elastic.co/u/randhirkr)\ **Post date:** [May 30, 2016, 6:58pm UTC](https://discuss.elastic.co/t/aws-iam-role-not-working-with-elasticsearch-5-0-0-alpha2-but-works-with-2-3-version/51347/1 "2016-05-30T18:58:05Z")
AWS IAM role not working with Elasticsearch 5.0.0-alpha2, but works with 2.3 version I am trying to use AWS IAM role with Elasticsearch 5.0.0-alpha2 and EC2 discovery plug-in, but it does not seem to be working and I am getting below error: > "Exception while retrieving instance list from AWS API: Authorization header or parameters are not formatted correctly. (Service: AmazonEC2; Status Code: 401; Error Code: AuthFailure" I am using below configuration with jdk8: > cluster.name: "test-cluster" > cloud.aws.region: "us-west-2" > cloud.aws.ec2.region: "us-west-2" > cloud.aws.ec2.protocol: "http" > discovery.type: "ec2" > #bootstrap.mlockall: true > node.master: true > node.data: false > node.name: ${HOSTNAME}-Master > discovery.zen.minimum\_master\_nodes: 1 > network.host: _ec2:privateIp_ > discovery.ec2.any\_group: true > discovery.ec2.groups : sg-9d856tfe However, same configuration works fine with with Elasticsearch 2.3 version. Has anyone faced the same issue with the latest Elasticsearch version 5.0.0-alpha2? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 30, 2016, 8:45pm UTC](https://discuss.elastic.co/t/aws-iam-role-not-working-with-elasticsearch-5-0-0-alpha2-but-works-with-2-3-version/51347/2 "2016-05-30T20:45:57Z")
Thanks for reporting! That's weird. Is `discovery.ec2.groups :` really like this (empty I mean)? What if you remove those 2 lines? ```auto discovery.ec2.any_group: true discovery.ec2.groups : ``` If you can narrow down what is the setting which is causing the issue, that would help a lot! ---
**Author:** ![randhirkr](https://avatars.discourse-cdn.com/v4/letter/r/9dc877/32.png) [@randhirkr](https://discuss.elastic.co/u/randhirkr)\ **Post date:** [May 31, 2016, 4:09am UTC](https://discuss.elastic.co/t/aws-iam-role-not-working-with-elasticsearch-5-0-0-alpha2-but-works-with-2-3-version/51347/3 "2016-05-31T04:09:36Z")
Thanks for response David. `discovery.ec2.groups` is not empty. It is security group id e.g. sg-9d856tfe. I am using security group for clustering so that instances belonging to same security group can be clustered. For your information, same configuration works if I provide access\_key and secret\_access\_key. Therefore, I feel problem happens when plugin is trying to fetch instance list while making AWS API call and its not using IAM role for this purpose. As per documentation, plug-in always tries to use IAM role first and if IAM role is not available, then only it should look for access\_key and secret\_access\_key and my elasticsearch instance is associated with IAM role with correct permission to fetch the instance list. This works fine 2.3 version with IAM role. As you suggested, I will remove below lines and try - but I am not sure if it will solve the problem that I am facing. discovery.ec2.any\_group: true discovery.ec2.groups : sg-9d856tfe Please let me know, if you need more info. Thanks! ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 31, 2016, 4:38am UTC](https://discuss.elastic.co/t/aws-iam-role-not-working-with-elasticsearch-5-0-0-alpha2-but-works-with-2-3-version/51347/4 "2016-05-31T04:38:04Z")
Ok. Thanks for the clarification. Could you open an issue in elasticsearch repo please with all those details? ---
**Author:** ![randhirkr](https://avatars.discourse-cdn.com/v4/letter/r/9dc877/32.png) [@randhirkr](https://discuss.elastic.co/u/randhirkr)\ **Post date:** [May 31, 2016, 4:41am UTC](https://discuss.elastic.co/t/aws-iam-role-not-working-with-elasticsearch-5-0-0-alpha2-but-works-with-2-3-version/51347/5 "2016-05-31T04:41:31Z")
Sure David, will do that. Thanks. ---
**Author:** ![randhirkr](https://avatars.discourse-cdn.com/v4/letter/r/9dc877/32.png) [@randhirkr](https://discuss.elastic.co/u/randhirkr)\ **Post date:** [May 31, 2016, 4:56pm UTC](https://discuss.elastic.co/t/aws-iam-role-not-working-with-elasticsearch-5-0-0-alpha2-but-works-with-2-3-version/51347/6 "2016-05-31T16:56:51Z")
Hi David, As you said, I have opened an issue in elasticsearch repo and It was indeed a bug. Below is the issue link: [https://github.com/elastic/elasticsearch/issues/18652](https://github.com/elastic/elasticsearch/issues/18652) Seems it got fixed now. However, I am not able to test this. I have removed the discovery-ec2 plug-in and installed again(as shown below), but getting the same error. > bin/elasticsearch-plugin remove discovery-ec2 > bin/elasticsearch-plugin install discovery-ec2 will it not download the latest code, if I install the discovery-ec2 plug-in again after removing the old one? Can you please help me here? Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:47pm UTC](https://discuss.elastic.co/t/aws-iam-role-not-working-with-elasticsearch-5-0-0-alpha2-but-works-with-2-3-version/51347/7 "2017-07-05T22:47:35Z")