Merge pull request #2959 from hashicorp/b-aws-iam-validation

provider/aws: Fail silently in ValidateCredentials for IAM users

builtin/providers/aws/config.go

@@ -180,11 +180,21 @@ func (c *Config) ValidateRegion() error {
  return fmt.Errorf("Not a valid region: %s", c.Region)
 }
 
-// Validate credentials early and fail before we do any graph walking
+// Validate credentials early and fail before we do any graph walking.
+// In the case of an IAM role/profile with insuffecient privileges, fail
+// silently
 func (c *Config) ValidateCredentials(iamconn *iam.IAM) error {
  _, err := iamconn.GetUser(nil)
 
  if awsErr, ok := err.(awserr.Error); ok {
+
+ if awsErr.Code() == "AccessDenied" || awsErr.Code() == "ValidationError" {
+ log.Printf("[WARN] AccessDenied Error with iam.GetUser, assuming IAM profile")
+ // User may be an IAM instance profile, or otherwise IAM role without the
+ // GetUser permissions, so fail silently
+ return nil
+ }
+
  if awsErr.Code() == "SignatureDoesNotMatch" {
  return fmt.Errorf("Failed authenticating with AWS: please verify credentials")
  }