Terraform works on some AWS regions and fails on others

Question

I'm new to Terraform so I may be missing something, but I did quiet a research and I didnt find a solution. We have companies AWS account with somw instances running already on region eu-west-1. I decided to test Terraform so we can start using it. I created IAM user with appropriate permissions and made this tf file:

resource "aws_instance" "test" {
    ami           = "ami-21abf052"
    instance_type = "t2.small"
}

terraform apply failed with the following error:

* aws_instance.test: Error launching source instance: timeout while waiting for state to become 'success' (timeout: 15s)

At first I thought it's the credentials problem, so I tried running the same from awscli:

aws ec2 run-instances --image-id ami-21abf052 --count 1 --instance-type t2.small

It worked like a charm. After that I tried many things including: using different IAM user, changing the permissions (giving "Allow" to ec2:*), using different AMIs, setting different VPCs, setting names, tags, different instance types, hardcoding the access_key and secret_key in .tf file, setting the region explicitly in the file (for awscli the default is eu-west-1). Anything I was doing the awscli was working and terraform failing.

After loosing one day I tried in region eu-central-1 and it just worked.

Am my missing something? Should I somehow add permissions for regions separately? Isn't awscli using the same ~/.aws/credentials file if I don't define it in .tf file?

aha, my current permissions in AWS:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:*",
                "iam:GetUser",
                "sts:GetCallerIdentity",
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

EDIT:
I tested more regions:

us-west-1 works
us-east-1 fails
sa-east-1 works

My AMIs:

variable "amis" {
    default = {
        eu-west-1 = "ami-21abf052"
        eu-central-1 = "ami-b0db1ddf"
        us-east-1 = "ami-e6d5d2f1"
        us-west-1 = "ami-bcb9eedc"
        sa-east-1 = "ami-ec811880"
    }
}

And versions Terraform v0.7.13 aws-cli/1.11.28 Python/2.7.12+ Linux/4.8.0-30-generic botocore/1.4.85

Forgot to mention: Terraform v0.7.13 aws-cli/1.11.28 Python/2.7.12+ Linux/4.8.0-30-generic botocore/1.4.85 — Mat
Yes, I use AMI from the appropriate region.. Today I will check other regions (US etc) to check how it is there — Mat
How long does it take until you get the time out in terraform? The error message says it's only 15s? Do you have a direct connection to the internet or is there maybe a proxy in between, which is configured for your AWS CLI, but not in terraform (provider)? — DJAlPee

helloV helloV · Accepted Answer · 2016-12-10T23:10:24

Have you tried instance types other than t2.small? Sometimes the region/AZ run out of specific instance types. In my experience, the instances fail to launch because AWS simply exceeded capacity. Most notably:

t2 instances in general
t2.small
eu regions

So the problem yo are seeing may not be related to Terraform. Try some other instance type (like m3.medium or m4.large) to rule out Terraform.

Also see: Error: InsufficientInstanceCapacity. The fact CLI was able to launch could be one instance was available at that time.

Terraform works on some AWS regions and fails on others

1 Answers