Verification of the instance profile failed. AWS error: You are not authorized to perform this operation

user_6247839 0
Viewed 1372

I encountered that error message when I tried to add IAM role in Databricks to allow "access data from Databricks clusters without the need to manage, deploy, or rotate AWS keys." Here's the steps I took to see the error message and the complete error messages are attached afterwards.

  1. Admin Console
  2. IAM Roles
  3. Click "Add IAM Role" button
  4. Enter the instance profile ARN into the textfield
  5. Click "Add" button.

Then Databricks was trying to verify the ARN profile information.

After 30 seconds or so, I saw the following complete error message:

Verification of the instance profile failed. AWS error: You are not authorized to perform this operation. In rare cases, the validation error is due to an AWS unavailability or misconfiguration, rather than an actual permission issue. In this case, you can skip the validation and forcibly add an IAM role using the API. If you do this, please try creating a cluster with the role to make sure it works properly.

amazon-iam databricks
2 Answers

What is likely going on is that the IAM role you used to launch your workspace does not have permission to use this instance profile. Databricks depends on the "PassRole" permission to start instances with your specified instance profile. Take a look at the public docs, specifically this step, to set up your workspace IAM role properly.

user_121004410

You should add the below snipped to the policy of the IAM role that manages the Databricks Workspace.

    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": "iam:PassRole",
        "Resource": "arn:aws:iam::my_account_id:role/my_role"
    },
user_131433790
Related