# ES Cloud AWS error 2.2.1

**URL:** <https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331>\
**Category:** Elasticsearch\
**Created:** [March 24, 2016, 10:11am UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331 "2016-03-24T10:11:11Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![DMNSteve](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@DMNSteve](https://discuss.elastic.co/u/DMNSteve)\
**Post date:** [March 24, 2016, 10:11am UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/1 "2016-03-24T10:11:11Z")

</div>

Hi,

Trying to setup a ES cluster in AWS. Managed to succeed and get discovery working with v1.7.

Ive now upgraded to v2.2.1 and im getting the following error

[2016-03-24 09:28:17,234][WARN][com.amazonaws.jmx.SdkMBeanRegistrySupport]  
java.security.AccessControlException: access denied ("javax.management.MBeanServerPermission" "findMBeanServer")  
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:474)  
at java.security.AccessController.checkPermission(AccessController.java:685)  
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)  
at javax.management.MBeanServerFactory.checkPermission(MBeanServerFactory.java:413)  
at javax.management.MBeanServerFactory.findMBeanServer(MBeanServerFactory.java:361)  
at com.amazonaws.jmx.MBeans.getMBeanServer(MBeans.java:111)  
at com.amazonaws.jmx.MBeans.registerMBean(MBeans.java:50)  
at com.amazonaws.jmx.SdkMBeanRegistrySupport.registerMetricAdminMBean(SdkMBeanRegistrySupport.java:27)  
at com.amazonaws.metrics.AwsSdkMetrics.registerMetricAdminMBean(AwsSdkMetrics.java:355)  
at com.amazonaws.metrics.AwsSdkMetrics.(AwsSdkMetrics.java:316)  
at com.amazonaws.AmazonWebServiceClient.requestMetricCollector(AmazonWebServiceClient.java:563)  
at com.amazonaws.AmazonWebServiceClient.isRMCEnabledAtClientOrSdkLevel(AmazonWebServiceClient.java:504)  
at com.amazonaws.AmazonWebServiceClient.isRequestMetricsEnabled(AmazonWebServiceClient.java:496)  
at com.amazonaws.AmazonWebServiceClient.createExecutionContext(AmazonWebServiceClient.java:457)  
at com.amazonaws.services.ec2.AmazonEC2Client.describeInstances(AmazonEC2Client.java:5924)  
at org.elasticsearch.discovery.ec2.AwsEc2UnicastHostsProvider.fetchDynamicNodes(AwsEc2UnicastHostsProvider.java:118)  
at org.elasticsearch.discovery.ec2.AwsEc2UnicastHostsProvider$DiscoNodesCache.refresh(AwsEc2UnicastHostsProvider.java:230)  
at org.elasticsearch.discovery.ec2.AwsEc2UnicastHostsProvider$DiscoNodesCache.refresh(AwsEc2UnicastHostsProvider.java:215)  
at org.elasticsearch.common.util.SingleObjectCache.getOrRefresh(SingleObjectCache.java:55)  
at org.elasticsearch.discovery.ec2.AwsEc2UnicastHostsProvider.buildDynamicNodes(AwsEc2UnicastHostsProvider.java:104)  
at org.elasticsearch.discovery.zen.ping.unicast.UnicastZenPing.sendPings(UnicastZenPing.java:335)  
at org.elasticsearch.discovery.zen.ping.unicast.UnicastZenPing.ping(UnicastZenPing.java:240)  
at org.elasticsearch.discovery.zen.ping.ZenPingService.ping(ZenPingService.java:106)  
at org.elasticsearch.discovery.zen.ping.ZenPingService.pingAndWait(ZenPingService.java:84)  
at org.elasticsearch.discovery.zen.ZenDiscovery.findMaster(ZenDiscovery.java:899)  
at org.elasticsearch.discovery.zen.ZenDiscovery.innerJoinCluster(ZenDiscovery.java:335)  
at org.elasticsearch.discovery.zen.ZenDiscovery.access$5000(ZenDiscovery.java:75)  
at org.elasticsearch.discovery.zen.ZenDiscovery$JoinThreadControl$1.run(ZenDiscovery.java:1260)  
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)  
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)  
at java.lang.Thread.run(Thread.java:745)

Any ideas?

---

<div class="post-metadata">

**Author:** ![ywelsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ywelsch/32/7751_2.png) [@ywelsch](https://discuss.elastic.co/u/ywelsch)\
**Post date:** [March 24, 2016, 10:26am UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/2 "2016-03-24T10:26:44Z")

</div>

This might be a bug in the ES AWS plugin. I've asked the plugin developer to have a look.

In the mean time, can you try adding the following permission to your `java.policy` and check if it works?

```auto
permission javax.management.MBeanServerPermission "createMBeanServer";

```

(to find `java.policy` see section "Customising the classloader whitelist" in  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-security.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-security.html) )

---

<div class="post-metadata">

**Author:** ![DMNSteve](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@DMNSteve](https://discuss.elastic.co/u/DMNSteve)\
**Post date:** [March 24, 2016, 10:56am UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/3 "2016-03-24T10:56:15Z")

</div>

Hi Yannick,

Thanks for this, i added the following

> permission javax.management.MBeanServerPermission "createMBeanServer";  
> permission javax.management.MBeanServerPermission "findMBeanServer";

and recieved a new error

> [2016-03-24 10:54:28,201][WARN][com.amazonaws.jmx.SdkMBeanRegistrySupport]  
> java.security.AccessControlException: access denied ("javax.management.MBeanPermission" "com.amazonaws.metrics.MetricAdmin#-[com.amazonaws.management:type=AwsSdkMetrics]" "registerMBean")  
> at java.security.AccessControlContext.checkPermission(AccessControlContext.java:474)  
> at java.security.AccessController.checkPermission(AccessController.java:685)  
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)  
> at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.checkMBeanPermission(DefaultMBeanServerInterceptor.java:1830)  
> at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.registerMBean(DefaultMBeanServerInterceptor.java:321)  
> at com.sun.jmx.mbeanserver.JmxMBeanServer.registerMBean(JmxMBeanServer.java:522)  
> at com.amazonaws.jmx.MBeans.registerMBean(MBeans.java:52)  
> at com.amazonaws.jmx.SdkMBeanRegistrySupport.registerMetricAdminMBean(SdkMBeanRegistrySupport.java:27)  
> at com.amazonaws.metrics.AwsSdkMetrics.registerMetricAdminMBean(AwsSdkMetrics.java:355)  
> at com.amazonaws.metrics.AwsSdkMetrics.(AwsSdkMetrics.java:316)  
> at com.amazonaws.AmazonWebServiceClient.requestMetricCollector(AmazonWebServiceClient.java:563)  
> at com.amazonaws.AmazonWebServiceClient.isRMCEnabledAtClientOrSdkLevel(AmazonWebServiceClient.java:504)  
> at com.amazonaws.AmazonWebServiceClient.isRequestMetricsEnabled(AmazonWebServiceClient.java:496)  
> at com.amazonaws.AmazonWebServiceClient.createExecutionContext(AmazonWebServiceClient.java:457)  
> at com.amazonaws.services.ec2.AmazonEC2Client.describeInstances(AmazonEC2Client.java:5924)  
> at org.elasticsearch.discovery.ec2.AwsEc2UnicastHostsProvider.fetchDynamicNodes(AwsEc2UnicastHostsProvider.java:118)  
> at org.elasticsearch.discovery.ec2.AwsEc2UnicastHostsProvider$DiscoNodesCache.refresh(AwsEc2UnicastHostsProvider.java:230)  
> at org.elasticsearch.discovery.ec2.AwsEc2UnicastHostsProvider$DiscoNodesCache.refresh(AwsEc2UnicastHostsProvider.java:215)  
> at org.elasticsearch.common.util.SingleObjectCache.getOrRefresh(SingleObjectCache.java:55)  
> at org.elasticsearch.discovery.ec2.AwsEc2UnicastHostsProvider.buildDynamicNodes(AwsEc2UnicastHostsProvider.java:104)  
> at org.elasticsearch.discovery.zen.ping.unicast.UnicastZenPing.sendPings(UnicastZenPing.java:335)  
> at org.elasticsearch.discovery.zen.ping.unicast.UnicastZenPing.ping(UnicastZenPing.java:240)  
> at org.elasticsearch.discovery.zen.ping.ZenPingService.ping(ZenPingService.java:106)  
> at org.elasticsearch.discovery.zen.ping.ZenPingService.pingAndWait(ZenPingService.java:84)  
> at org.elasticsearch.discovery.zen.ZenDiscovery.findMaster(ZenDiscovery.java:899)  
> at org.elasticsearch.discovery.zen.ZenDiscovery.innerJoinCluster(ZenDiscovery.java:335)  
> at org.elasticsearch.discovery.zen.ZenDiscovery.access$5000(ZenDiscovery.java:75)  
> at org.elasticsearch.discovery.zen.ZenDiscovery$JoinThreadControl$1.run(ZenDiscovery.java:1260)  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)  
> at java.lang.Thread.run(Thread.java:745)

any further ideas?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 24, 2016, 11:07am UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/4 "2016-03-24T11:07:33Z")

</div>

Could you open an issue with all those details please?

Thanks for reporting!

---

<div class="post-metadata">

**Author:** ![DMNSteve](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@DMNSteve](https://discuss.elastic.co/u/DMNSteve)\
**Post date:** [March 24, 2016, 11:15am UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/5 "2016-03-24T11:15:17Z")

</div>

> <https://github.com/elastic/elasticsearch/issues/17318>

No worries at all! 🙂

---

<div class="post-metadata">

**Author:** ![ywelsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ywelsch/32/7751_2.png) [@ywelsch](https://discuss.elastic.co/u/ywelsch)\
**Post date:** [March 24, 2016, 11:33am UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/6 "2016-03-24T11:33:47Z")

</div>

Can you add some more permissions?

```auto
permission javax.management.MBeanPermission "com.amazonaws.metrics.*", "*";

```

Thanks a lot for helping us figure this out.

---

<div class="post-metadata">

**Author:** ![DMNSteve](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@DMNSteve](https://discuss.elastic.co/u/DMNSteve)\
**Post date:** [March 24, 2016, 2:32pm UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/7 "2016-03-24T14:32:53Z")

</div>

```
permission javax.management.MBeanServerPermission "createMBeanServer";
permission javax.management.MBeanServerPermission "findMBeanServer";
permission javax.management.MBeanPermission "com.amazonaws.metrics.*", "*";
permission javax.management.MBeanTrustPermission "register";

```

Those 4 have gotten rid of the fatals in the logs. But still cant get my 2 nodes talking.

Thanks

---

<div class="post-metadata">

**Author:** ![DMNSteve](https://avatars.discourse-cdn.com/v4/letter/d/13edae/32.png) [@DMNSteve](https://discuss.elastic.co/u/DMNSteve)\
**Post date:** [March 24, 2016, 2:41pm UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/8 "2016-03-24T14:41:58Z")

</div>

This is my elasticsearch.yml

```
cloud:
  aws:
    region: eu-west-1
cluster:
  name: elasticsearch
discovery:
  ec2:
    availability_zones: eu-west-1a, eu-west-1b
    groups: security-group-elasticsearch
    host_type: private_ip
    ping_timeout: 30s
  type: ec2
network:
  port: 9200
node:
  name: elasticsearch-2
path:
  data: /usr/share/elasticsearch/data/elasticsearch-2
  logs: /var/log/elasticsearch/elasticsearch-2

```

I have setup the IAMs roles as described in the cloud aws documentation

---

<div class="post-metadata">

**Author:** ![ywelsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ywelsch/32/7751_2.png) [@ywelsch](https://discuss.elastic.co/u/ywelsch)\
**Post date:** [March 24, 2016, 4:58pm UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/9 "2016-03-24T16:58:07Z")

</div>

Settings look ok to me.

Can you set the log-level to DEBUG for discovery packages and see if anything particular stands out?

org.elasticsearch.discovery.ec2  
org.elasticsearch.discovery.zen

We will do testing on our end as well.

---

<div class="post-metadata">

**Author:** ![Andrew\_Stangl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_stangl/32/2227_2.png) [@Andrew\_Stangl](https://discuss.elastic.co/u/Andrew_Stangl)\
**Post date:** [March 30, 2016, 10:42am UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/10 "2016-03-30T10:42:12Z")

</div>

It's worth noting that ES 2.x defaults to binding only to localhost.

I was experiencing the same issue, and adding:

```auto
network.host: 0.0.0.0

```

to elasticsearch.yml, fixed the issue for me .. hope that helps someone

---

<div class="post-metadata">

**Author:** ![ywelsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ywelsch/32/7751_2.png) [@ywelsch](https://discuss.elastic.co/u/ywelsch)\
**Post date:** [April 12, 2016, 2:57pm UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/11 "2016-04-12T14:57:39Z")

</div>

As I've written on the linked ES Github issue, these AccessControlException warnings are not affecting the functionality of the EC2 discovery plugin. The issue must be a misconfiguration (see suggestion by @DMNSteve). In case the issue is not resolved by the above suggestion, please turn logging of "org.elasticsearch.discovery.ec2" to TRACE so we can get more insight into what's happening.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:00pm UTC](https://discuss.elastic.co/t/es-cloud-aws-error-2-2-1/45331/12 "2017-07-05T23:00:05Z")

</div>