vmimport role does not have the required permissions

"vmimport" role does not have the required permissions

Challange 

A Cloud Site fails to launch with an error message that indicates a service role is lacking permissions similar to the screenshot below:



Cause

Even though the vmimport role is supposed to be created automatically according to the provided Cloud Formation Template in AWS, some of its permissions might not have been assigned correctly and require manual actions. 

Solution

Here are the steps for adding the necessary permissions to the vmimport role. You can go directly to Step 3 if the role has already been created, and you only need to specify the exact policy.

To create the service role:


Step 1.   Create a file named trust-policy.json with the following policy:

  1. { 
  2.     "Version": "2012-10-17", 
  3.     "Statement": [ 
  4.         { 
  5.             "Effect": "Allow", 
  6.             "Principal": { "Service": "vmie.amazonaws.com" }, 
  7.             "Action": "sts:AssumeRole", 
  8.             "Condition": { 
  9.                 "StringEquals":{ 
  10.                     "sts:Externalid": "vmimport" 
  11.                 } 
  12.             } 
  13.         } 
  14.     ] 
  15. }


The file can be saved anywhere on the computer. Take note of the location of the file as it will be needed in the next step. 

Step 2. Use the create-role command to create a role named vmimport and give VM Import/Export access to it. Ensure that the full path to the location of the trust-policy.json file is specified and that you prefix file:// to it as in the following example: 

  1. aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json 
If you encounter an error stating that "This policy contains invalid Json," double-check that the path to the JSON file is provided correctly. 

Step 3. Create a file named role-policy.json with the following policy, where disk-image-file-bucket is the bucket where the disk images are stored: 
  1. { 
  2.     "Version":"2012-10-17", 
  3.     "Statement":[ 
  4.         { 
  5.             "Effect":"Allow", 
  6.             "Action":[ 
  7.                 "s3:GetBucketLocation", 
  8.                 "s3:GetObject", 
  9.                 "s3:ListBucket" 
  10.             ], 
  11.             "Resource":[ 
  12.                 "arn:aws:s3:::disk-image-file-bucket", 
  13.                 "arn:aws:s3:::disk-image-file-bucket/*" 
  14.             ] 
  15.         }, 
  16.         { 
  17.             "Effect":"Allow", 
  18.             "Action":[ 
  19.                 "ec2:ModifySnapshotAttribute", 
  20.                 "ec2:CopySnapshot", 
  21.                 "ec2:RegisterImage", 
  22.                 "ec2:Describe*" 
  23.             ], 
  24.             "Resource":"*" 
  25.         } 
  26.     ] 
  27. } 


Step 4. Use the following put-role-policy command to attach the policy to the role created above. Ensure that the full path to the location of the role-policy.json file is specified. 


  1. aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json 

As the result, you should have a service role with all the necessary permissions to launch a Cloud Site in your target AWS environment.