Termination Reason: Client.InternalError: Client error on launch

user_8775160 0
Viewed 9875

please help

How to make sure EC2 is using the custom KMS key; we are using terraform to deploy the EC2 instance, every time the EC2 instance is launched in an auto-scaling group, it crashes with the below error. Seems like the EC2 instance has no access to KMS key

Error: Termination Reason: Client.InternalError: Client error on launch

resource "aws_autoscaling_group" "autoscaling-group" {
  name                 = var.name
  availability_zones   = var.availability_zones
  min_size             = var.min_size
  desired_capacity     = var.desired_capacity
  max_size             = var.max_size
  health_check_type    = "EC2"
  launch_configuration = aws_launch_configuration.launch_configuration.name
  vpc_zone_identifier  = local.subnet_id
  termination_policies = ["OldestInstance"]
}

resource "aws_launch_configuration" "launch_configuration" {
  name                        = var.name
  image_id                    = var.ami
  instance_type               = var.instance_type
  iam_instance_profile        = var.iam_instance_profile_name
  security_groups             = [aws_security_group.security_group.id]
  associate_public_ip_address = true
}

resource "aws_autoscaling_policy" "autoscaling-policy" {
  name                      = var.name
  policy_type               = "TargetTrackingScaling"
  estimated_instance_warmup = "90"
  adjustment_type           = "ChangeInCapacity"
  autoscaling_group_name    = aws_autoscaling_group.autoscaling-group.name
}

-- Thank you

terraform-provider-aws terraform amazon-ec2
3 Answers

Thank you All for your support, I was able to resolve; The issue was with the kms key grant for ec2 auto scaling service we used the below module and the issue got resolved

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_grant

resource "aws_kms_grant" "a" {
  name              = "my-grant"
  key_id            = aws_kms_key.a.key_id
  grantee_principal = aws_iam_role.a.arn
  operations        = ["Encrypt", "Decrypt", "GenerateDataKey"]

}
user_87751600

You can execute the plan with TF_LOG=DEBUG to get more details about what is missing. You mostly need a Service-Linked role in order to get pass the permission issue

user_1917970

Command to be executed on Target account:

aws kms create-grant --region <Region> --key-id arn:aws:kms:<Region>:111111111111:key/<Key-ID> --grantee-principal arn:aws:iam::999999999999:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling --operations "Encrypt" "Decrypt" "ReEncryptFrom" "ReEncryptTo" "GenerateDataKey" "GenerateDataKeyWithoutPlaintext" "DescribeKey" "CreateGrant"

  • Region: same region where AMI and ASG to be created

  • Source account: 111111111111 (AMI from which EBS is encrypted)

  • Target account: 999999999999 (ASG to be created from Source account AMI)

  • Snapshot KMS Key: (Go to AMI of Source account and check snapshot)

  • IAM Role of Target account:

    arn:aws:iam::999999999999:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling
user_112567010
Related