Welcome! Please see the About page for a little more info on how this works.

Ask a Question

How do I connect to a running Datomic system using AWS profiles and assumed roles?

0 votes
in dev-tools by

I have a running Datomic Cloud system with a split stack and solo compute.

aws ec2 describe-instances \
  --profile $PROFILE \
  --region $REGION \
  --filters "Name=tag-key,Values=datomic:tx-group" "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].[Tags[?Key==`datomic:system`].Value]' \
  --output text

Returns a single line with "redacted-alpha-storage", which is what I expect. When I run datomic --profile $PROFILE cloud list-systems I get this:

WARNING: When invoking clojure.main, use -M
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Execution error (ExceptionInfo) at datomic.tools.ops.aws/invoke! (aws.clj:83).
AWS Error: Unable to fetch credentials. See log for more details.

Full report at:
/tmp/clojure-1871270413711860346.edn

I've not seen any mention of a log, and can't find any log file in the current directory. I've looked at the full report, which looks like this:

{:clojure.main/message
 "Execution error (ExceptionInfo) at datomic.tools.ops.aws/invoke! (aws.clj:83).\nAWS Error: Unable to fetch credentials. See log for more details>
 :clojure.main/triage
 {:clojure.error/class clojure.lang.ExceptionInfo,
  :clojure.error/line 83,
  :clojure.error/cause
  "AWS Error: Unable to fetch credentials. See log for more details.",
  :clojure.error/symbol datomic.tools.ops.aws/invoke!,
  :clojure.error/source "aws.clj",
  :clojure.error/phase :execution},
 :clojure.main/trace
 {:via
  [{:type clojure.lang.ExceptionInfo,
    :message
    "AWS Error: Unable to fetch credentials. See log for more details.",
    :data
    {:cognitect.anomalies/category :cognitect.anomalies/fault,
     :cognitect.anomalies/message
     "Unable to fetch credentials. See log for more details."},
    :at
    [datomic.tools.ops.aws$invoke_BANG_ invokeStatic "aws.clj" 83]}],
  :trace
  [[datomic.tools.ops.aws$invoke_BANG_ invokeStatic "aws.clj" 83]
   [datomic.tools.ops.aws$invoke_BANG_ invoke "aws.clj" 70]
   [datomic.tools.ops.aws$results_seq$fn__12733 invoke "aws.clj" 91]
   [clojure.lang.LazySeq sval "LazySeq.java" 42]
   [clojure.lang.LazySeq seq "LazySeq.java" 51]
   [clojure.lang.RT seq "RT.java" 535]
   [clojure.core$seq__5402 invokeStatic "core.clj" 137]
   [clojure.core.protocols$seq_reduce invokeStatic "protocols.clj" 24]
   [clojure.core.protocols$fn__8146 invokeStatic "protocols.clj" 75]
   [clojure.core.protocols$fn__8146 invoke "protocols.clj" 75]
   [clojure.core.protocols$fn__8088$G__8083__8101
    invoke
    "protocols.clj"
    13]
   [clojure.core$transduce invokeStatic "core.clj" 6884]
   [clojure.core$into invokeStatic "core.clj" 6899]
   [clojure.core$into invoke "core.clj" 6887]
   [datomic.tools.ops.cloud$list_systems invokeStatic "cloud.clj" 31]
   [datomic.tools.ops.cloud$list_systems invoke "cloud.clj" 16]
   [datomic.tools.ops.cli.cloud$eval12960$fn__12961
    invoke
    "cloud.clj"
    60]
   [clojure.lang.MultiFn invoke "MultiFn.java" 229]
   [datomic.tools.ops$_main invokeStatic "ops.clj" 83]
   [datomic.tools.ops$_main doInvoke "ops.clj" 76]
   [clojure.lang.RestFn applyTo "RestFn.java" 137]
   [clojure.lang.Var applyTo "Var.java" 705]
   [clojure.core$apply invokeStatic "core.clj" 665]
   [clojure.main$main_opt invokeStatic "main.clj" 514]
   [clojure.main$main_opt invoke "main.clj" 510]
   [clojure.main$main invokeStatic "main.clj" 664]
   [clojure.main$main doInvoke "main.clj" 616]
   [clojure.lang.RestFn applyTo "RestFn.java" 137]
   [clojure.lang.Var applyTo "Var.java" 705]
   [clojure.main main "main.java" 40]],
  :cause
  "AWS Error: Unable to fetch credentials. See log for more details.",
  :data
  {:cognitect.anomalies/category :cognitect.anomalies/fault,
   :cognitect.anomalies/message
   "Unable to fetch credentials. See log for more details."}}}

Given the AWS CLI works I think this is a Datomic issue but I could be mistaken. I'm able to use my AWS profile to access the target AWS account; it's only the Datomic CLI that's having problems.

1 Answer

0 votes
by

I've gotten things working by creating dedicated IAM users in each sub-account, and by granting full admin privileges to these users. Before attaching the admin policy I encountered the following error from the Datomic CLI:

Execution error (ExceptionInfo) at datomic.tools.ops.aws/invoke! (aws.clj:83).
AWS Error: User: arn:aws:iam::111111111111:user/datomic-admin is not
  authorized to perform: autoscaling:DescribeAutoScalingGroups

I'd love to be able to use STS and assumed roles, and it would have been really helpful if there was a generated policy that would get the Datomic CLI working out of the box.

Hopefully this information helps the next person who wants to deploy this amazing technology. Bon voyage!

...