{"record":{"id":"d1f9095622a1952f","repo":"zeroclaw-labs/zeroclaw","slug":"no-iam-role-attached-to-this-instance","errorCode":null,"errorMessage":"No IAM role attached to this instance","messagePattern":"No IAM role attached to this instance","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-providers/src/bedrock.rs","lineNumber":235,"sourceCode":"        // Step 1: get IMDSv2 token\n        let token = client\n            .put(\"http://169.254.169.254/latest/api/token\")\n            .header(\"X-aws-ec2-metadata-token-ttl-seconds\", \"21600\")\n            .send()\n            .await?\n            .text()\n            .await?;\n\n        // Step 2: get IAM role name\n        let role = client\n            .get(\"http://169.254.169.254/latest/meta-data/iam/security-credentials/\")\n            .header(\"X-aws-ec2-metadata-token\", &token)\n            .send()\n            .await?\n            .text()\n            .await?;\n        let role = role.trim().to_string();\n        anyhow::ensure!(!role.is_empty(), \"No IAM role attached to this instance\");\n\n        // Step 3: get credentials for that role\n        let creds_url = format!(\n            \"http://169.254.169.254/latest/meta-data/iam/security-credentials/{}\",\n            role\n        );\n        let creds_json: serde_json::Value = client\n            .get(&creds_url)\n            .header(\"X-aws-ec2-metadata-token\", &token)\n            .send()\n            .await?\n            .json()\n            .await?;\n\n        let access_key_id = creds_json[\"AccessKeyId\"]\n            .as_str()\n            .ok_or_else(|| {\n                ::zeroclaw_log::record!(","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-providers/src/bedrock.rs#L217-L253","documentation":"The Bedrock provider's from_imds credential path queries EC2 instance metadata (169.254.169.254) for the IAM security-credentials role list. The IMDS endpoint responded (with a valid token), but the role list came back empty, meaning no instance profile is attached, so no credentials can be derived from the instance.","triggerScenarios":"EC2 (or ECS/ECR-based) workload launched without an IAM instance profile; the role was attached in IAM but not as an instance profile on the instance; containers where the metadata hop limit prevents reaching the credentials path so only an empty role list is visible; a non-AWS environment where something else answers on 169.254.169.254.","commonSituations":"Terraform/CloudFormation templates that create the role but forget the instance-profile association; containers on EC2 needing --http-put-response-hop-limit 2; developers assuming AWS_* env-var-less code will just work on a bare instance.","solutions":["Attach an IAM instance profile whose role has Bedrock permissions to the instance, then re-run","For containers on EC2, raise the metadata hop limit: aws ec2 modify-instance-metadata-options --instance-id i-... --http-put-response-hop-limit 2","Provide explicit credentials instead (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a named profile) and skip IMDS"],"exampleFix":"# before: instance without profile\naws ec2 associate-iam-instance-profile \\\n  --instance-id i-1234 \\\n  --iam-instance-profile Name=bedrock-runner-role","handlingStrategy":"fallback","validationCode":"# probe IMDS for an attached role before relying on it\nTOKEN=$(curl -sf -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60') && \\\nROLE=$(curl -sf http://169.254.169.254/latest/meta-data/iam/security-credentials/ -H \"X-aws-ec2-metadata-token: $TOKEN\") && \\\n[ -n \"$ROLE\" ] || echo 'no instance profile — attach one or use explicit credentials' >&2","typeGuard":null,"tryCatchPattern":"when constructing the Bedrock provider, try IMDS credentials; on the no-IAM-role error fall back to explicit credentials (environment/profile) before giving up, and log which path succeeded","preventionTips":["Attach instance profiles at launch via infrastructure-as-code, not afterwards by hand","For containerized workloads on EC2 set the metadata hop limit to 2","Expose AWS credential configuration (env vars/profile) in environments where IMDS is unavailable"],"tags":["aws","bedrock","iam","imds","credentials","network","rust"],"backgroundTag":"missing-iam-instance-profile","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}