# AWS metricbeat config, Access Denied **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [April 17, 2020, 4:30pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548 "2020-04-17T16:30:21Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 17, 2020, 4:30pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/1 "2020-04-17T16:30:21Z")
Hello, I am trying to configure Metricbeat to collect AWS metrics. I have tried configuring it to use credential profile and even explicity setting the access keys inside the yml. It keeps saying I dont have enough permissions to DescribeRegions. I tried giving the user higher permissions which includes that and still the same issue. Any help on this would be great. I am also using the latest version of Elastic/Beats. ```auto - module: aws period: 1m metricsets: - elb - usage access_key_id: '' secret_access_key: '' credential_profile_name: default regions: - us-east-1 - module: aws period: 5m access_key_id: ''" secret_access_key: ''" credential_profile_name: default metricsets: - cloudwatch metrics: - namespace: AWS/EC2 #name: ["CPUUtilization", "DiskWriteOps"] #dimensions: # - name: InstanceId # value: i-0686946e22cf9494a #statistic: ["Average", "Maximum"] regions: - us-east-1 - module: aws period: 5m access_key_id: '' secret_access_key: '' metricsets: - ebs - ec2 - sns - sqs - rds regions: - us-east-1 - module: aws period: 12h access_key_id: '' secret_access_key: '' metricsets: - billing regions: - us-east-1 - module: aws period: 24h access_key_id: '' secret_access_key: '' metricsets: - s3_daily_storage - s3_request ``` Thanks, Kenneth ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 17, 2020, 9:46pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/2 "2020-04-17T21:46:42Z")
Weird issue, I can send billing metrics no problem but all other resources that require DescribeRegion fail. Could this be a possible bug? I gave my user Ec2FullAccess and also explicitly gave that permission. ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 20, 2020, 4:25pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/3 "2020-04-20T16:25:24Z")
Was anyone able to take a look at this? ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [April 20, 2020, 6:11pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/4 "2020-04-20T18:11:08Z")
Hi @kmroz, thanks for posting your question here! Could you by any chance to copy your policy JSON file here please? You can find it in IAM console on AWS. Here is what mine looks like: ```auto { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor3", "Effect": "Allow", "Action": [ "tag:GetResources", "ec2:DescribeInstances", "cloudwatch:GetMetricData", "ec2:DescribeRegions", "iam:ListAccountAliases", "sts:GetCallerIdentity", "cloudwatch:ListMetrics" ], "Resource": "*" } ] } ``` ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [April 20, 2020, 6:12pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/5 "2020-04-20T18:12:33Z")
Also if you want to verify if the credentials you use in shared credential file is good, you can try some basic AWS CLIs locally like [https://docs.aws.amazon.com/cli/latest/reference/iam/list-account-aliases.html](https://docs.aws.amazon.com/cli/latest/reference/iam/list-account-aliases.html) ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 20, 2020, 6:16pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/6 "2020-04-20T18:16:07Z")
```auto { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ec2:DescribeRegions", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "tag:getResources", "sts:GetCallerIdentity", "iam:ListAccountAliases", "ec2:DescribeInstances", "rds:DescribeDBInstances", "sqs:ListQueues" ], "Resource": "*" } ] } ``` ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 20, 2020, 6:24pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/7 "2020-04-20T18:24:18Z")
also I am able to confirm via the CLI i can describe regions. ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [April 20, 2020, 7:09pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/8 "2020-04-20T19:09:38Z")
Thank you!!! The permission seems fine hmmm Could you try start Metricbeat with config file aws.yml only includes ec2 metricset and copy paste your whole Metricbeat log to here please? ```auto - module: aws period: 5m credential_profile_name: metricsets: - ec2 ``` Thanks again! - Kaiyan ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 20, 2020, 7:14pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/9 "2020-04-20T19:14:54Z")
```auto 1 error: error creating aws metricset: Failed DescribeRegions: UnauthorizedOperation: You are not authorized to perform this operation. ``` Is the error i have recieved. ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [April 20, 2020, 8:21pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/10 "2020-04-20T20:21:55Z")
I just downloaded the latest Metricbeat (version 7.6.2) and used config: ```auto - module: aws period: 5m credential_profile_name: elastic-beats metricsets: - ec2 ``` I was able to collect metrics from EC2 instances. When you tested with AWS CLI, what credential did you use? If you copy these credentials directly into the aws.yml config, do you also get the same error? ```auto - module: aws period: 5m access_key_id: <'access key id'> secret_access_key: <'secret access key'> session_token: <'if you have a session token'> metricsets: - ec2 ``` ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 20, 2020, 8:26pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/11 "2020-04-20T20:26:16Z")
Hey , Yes , i have tried both pasting in the config and using the profile\_name. It gives me the same error. ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 20, 2020, 10:02pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/12 "2020-04-20T22:02:10Z")
so, it seems after doing a daemon-reload ec2 started to work. I am now running into the issue with S3 saying i need to DescrbeRegions ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 20, 2020, 10:11pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/13 "2020-04-20T22:11:53Z")
weirdly enough had to add regions sections to this to get it working. I think i am running now. Thank you ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [April 20, 2020, 11:05pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/14 "2020-04-20T23:05:31Z")
oh no... I can't think of anything if the config is right though hmmm I can't reproduce it on my side ☹ If you run `./metricbeat -e -d '*'` to enable debug log, will you able to see any other information might be useful? ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [April 20, 2020, 11:06pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/15 "2020-04-20T23:06:11Z")
Ahh great! I didn't see your recent comments! Thanks for letting me know!! ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [April 21, 2020, 1:48pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/16 "2020-04-21T13:48:23Z")
No problem, thanks for helping out! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 19, 2020, 1:48pm UTC](https://discuss.elastic.co/t/aws-metricbeat-config-access-denied/228548/17 "2020-05-19T13:48:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.