I’m in class trying to spin up a VPC with 2 EC2 instances. Instead of doing it via the UI, I set up all the instances using Terraform. The problem is, I am able to spin up instances using the UI, but am unable to spin up instances using Terraform.

I understand that the issue lays with the fact my user ARN does not have the necessary permissions, but how come it’s possible to create an instance using the UI using the same user?

The EC2.tf looks like:

resource "aws_instance" "mysql-db" {
    ami = "ami-0427090fd1714168b"
    instance_type = "t3.micro"
    subnet_id = aws_subnet.private.id
    vpc_security_group_ids = [aws_security_group.mysqldb.id]
    key_name = "vockey"

    tags = {
        Name = "mysql-db"
    }
    user_data = file("db-userdata.sh")
}

The error I get:

UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::0:user/awsstudent is not authorized to perform:
 ec2:RunInstances on resource: arn:aws:ec2:us-east-1:0:volume/* with an explicit deny in an identity-based policy

I understand that the issue lays with Terraform trying to create an EBS volume perhaps? Every EC2 gets an EBS volume on creation, and I am able to create an EC2 via the UI, but not in Terraform.

I tried to explicitly create an EBS volume inside the aws_instance configuration, however that did not work.