Bug 1831577

Summary:	New AWS accounts cannot create Spot Instances
Product:	OpenShift Container Platform	Reporter:	Joel Speed <jspeed>
Component:	Cloud Compute	Assignee:	Joel Speed <jspeed>
Cloud Compute sub component:	Other Providers	QA Contact:	sunzhaohua <zhsun>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	unspecified
Version:	4.5
Target Milestone:	---
Target Release:	4.5.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	If this bug requires documentation, please select an appropriate Doc Type value.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-13 17:35:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Joel Speed 2020-05-05 10:32:24 UTC

Description of problem:

If an OCP cluster attempts to create a Spot instance on AWS, which has not already had a spot instance launched in it, then it will fail with the following error:

```
Error launching instance: AuthFailure.ServiceLinkedRoleCreationNotPermitted: The provided credentials do not have permission to create the service-linked role for EC2 Spot Instances.
```

Version-Release number of selected component (if applicable): 4.5


How reproducible:
Easily given a new AWS account can be created

Alternatively I believe deleting the service linked role would recreate this issue (AWSServiceRoleForEC2Spot)


Steps to Reproduce:
1. Create a brand new AWS account
2. Install an OCP 4.5 cluster
3. Attempt to create a spot instance

Actual results:

Machine controller logs error when attempting to create the spot instances

Expected results:

Spot instances are created without issue

Additional info:

Comment 3 sunzhaohua 2020-05-12 10:36:20 UTC

Verified

clusterversion: 4.5.0-0.nightly-2020-05-10-231314 

$ oc edit CredentialsRequest -n openshift-cloud-credential-operator openshift-machine-api-aws    statementEntries:
    - action:
      - iam:CreateServiceLinkedRole

I don't have a new aws account, but create spot instance, didn't met this error. Move it to verified, if meet this problem again, will reopen it.

Comment 4 errata-xmlrpc 2020-07-13 17:35:00 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409