New IAM admin user sees “You are not authorized to perform this operation”

Question

I am trying to get started with the AWS CLI on OSX. I installed aws via pip. I have created a new user in IAM and attached the pre-built AdministratorAcce

Answer 1

Your AWS CLI is getting credentials from somewhere else. See Configuration Settings and Precedence

Make sure it is not getting the credentials from environment variables or from other locations. The AWS CLI looks for credentials and configuration settings in the following order:

• Command Line Options – region, output format and profile can be specified as command options to override default settings.
• Environment Variables – AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, etc.
• The AWS credentials file – located at ~/.aws/credentials on Linux, OS X, or Unix, or at C:\Users\USERNAME .aws\credentials on Windows. This file can contain multiple named profiles in addition to a default profile.
• The CLI configuration file – typically located at ~/.aws/config on Linux, OS X, or Unix, or at C:\Users\USERNAME .aws\config on Windows. This file can contain a default profile, named profiles, and CLI specific configuration parameters for each.
• Instance profile credentials – these credentials can be used on EC2 instances with an assigned instance role, and are delivered through the Amazon EC2 metadata service.

Answer 2

Make sure you are not creating the security group in VPC, if this is the case you need to pass default VPC ID as a parameter.

Also try this with different regions:

aws configure set region <regions>
aws ec2 describe-security-groups

NOTE: AWS has started providing default VPC's in most of the regions.

Hope this helps and resolve your issue.

Answer 3

In my case this was caused by not having the correct policy attached to the IAM user I was authenticating with.

Attach the AmazonEC2FullAccess policy to the user in the IAM Management Console and the command should work.