I had to start some EC2 instances programmatically from inside an AWS lambda function. My code looked something like this:
import boto3 def handler(event, context): client = boto3.client('ec2') client.start_instances(InstanceIds=['i-0123456789abcdef0', ...])
This worked fine when I ran it from the command line, but when I ran it from inside the lambda, one particular instance stubbornly refused to start, even though the lambda ran without errors.
It turned out that the problem was a permissions issue. This particular instance had an additional encrypted EBS volume attached. The call to
start_instances() was failing silently.
To fix this, make sure that the role under which your code runs is granted the
It took me a bit of trial and error to figure out which permission to add, but I wanted to make sure I got this one right. You should never give your code any more permissions than the bare minimum it needs in order to do what it needs to do. Unfortunately, figuring out exactly which permissions your code needs to run can sometimes be a bit of a challenge…