# Discovery-ec2 plugin cannot connect to AWS API - 403 Forbidden

**URL:** <https://discuss.elastic.co/t/discovery-ec2-plugin-cannot-connect-to-aws-api-403-forbidden/200153>\
**Category:** Elasticsearch\
**Created:** [September 19, 2019, 8:49am UTC](https://discuss.elastic.co/t/discovery-ec2-plugin-cannot-connect-to-aws-api-403-forbidden/200153 "2019-09-19T08:49:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cknoell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cknoell/32/47353_2.png) [@cknoell](https://discuss.elastic.co/u/cknoell)\
**Post date:** [September 19, 2019, 8:49am UTC](https://discuss.elastic.co/t/discovery-ec2-plugin-cannot-connect-to-aws-api-403-forbidden/200153/1 "2019-09-19T08:49:18Z")

</div>

Hi,

I'm trying to setup an elastic cluster (Using version 7.3.2) across three different AZs in one region. EC2 instances are able to communicate with each other, as routing and security-groups are configured to so. AWS API User has the following IAM profile:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        }
    ]
}

```

So this user has more rights as describe in the documentation ([ec2-discovery documentation](https://www.elastic.co/guide/en/elasticsearch/plugins/7.3/discovery-ec2-usage.html))

I'm running the following config:

```
path.data: /elastic
path.logs: /elastic
node.name: aws-siem-cluster-node-2
cluster.name: aws-siem-cluster
discovery.seed_providers: ec2
discovery.ec2.endpoint: apigateway.eu-central-1.amazonaws.com
discovery.ec2.protocol: https
discovery.ec2.read_timeout: 60s
discovery.ec2.groups: launch-wizard-2
discovery.ec2.any_group: true
discovery.ec2.host_type: private_ip
discovery.ec2.availability_zones: eu-central-1
cloud.node.auto_attributes: true
cluster.routing.allocation.awareness.attributes: aws_availability_zone
network.host: _ec2_

```

Keystore values for API Key and Secret are stored.

Setting Logoutput to DEBUG of elastic log we have this main cause:

Main issue seems to be that part: **`Exception while retrieving instance list from AWS API: null (Service: AmazonEC2; Status Code: 403; Error Code: 403 Forbidden; Request ID: null)`**  
Any advice about what could be wrong here ? Thanks in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 17, 2019, 8:49am UTC](https://discuss.elastic.co/t/discovery-ec2-plugin-cannot-connect-to-aws-api-403-forbidden/200153/2 "2019-10-17T08:49:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.