I am attempting to create my own bastion host for a VPC, and created an auto-scaling group with min/max instances of 1. In my launch configurations, I specify the following for the ec2 user data:

The goal of this user data is to immediately associate an Elastic IP address with my newly created EC2 instance – I’ve read from other StackOverflow posts that this must be explicitly done when using ASGs.

However, after the ASG instance spins up and finishes initializing, I still do not see any Elastic IP in my console output for the instance:

I’ve confirmed that the user data is indeed being used by the instance:

I tried to look inside the system log to see if there were any error messages during the initialization, but I couldn’t see anything at first that would suggest that the associate-address command failed (inside /var/log/cloud-init-output).

Edit: Attempt to debug:

However, I then manually associated the Elastic IP with my instance, SSHed, and attempted to run the user data commands above. Interestingly, when I got to the aws ec2 associate-address portion, I ran into

Unable to locate credentials. You can configure credentials by running
“aws configure”.

This appears to be at the root of the issue – my AWS profile is not configured. However, I’ve always been under the impression that a default AWS instance profile is set up for you with access to the AWS CLI when the instance finishes initializing.

Could anyone point me in the direction of why my user data to associate elastic IP addresses might not be executing properly?

Thank you!

It looks the instance profile attached to this EC2 instance does not have permission to perform the above task.

Referring to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-ec2-console.html#ex-eip,

Can you make sure your Instance profile has the following action allowed?

Sample policy would look like:

Hope this helps.