Takeaway: When IAM roles “don’t work,” always verify metadata reachability before touching permissions.

This happens because the application inside the instance cannot access the instance metadata service, even though the IAM role itself is correctly attached.

In Amazon Web Services, credentials for an instance role are delivered through the metadata endpoint at 169.254.169.254. If that endpoint is blocked, disabled, or requires IMDSv2 while your SDK expects IMDSv1, the SDK reports missing credentials.

Start by checking whether metadata access is enabled on the instance. Then verify whether IMDSv2 is enforced and whether your SDK version supports it. You can quickly test access from the instance with:

If this fails, inspect security hardening scripts, iptables rules, or container network settings that may block the endpoint.

A common mistake is assuming the IAM role alone guarantees access. It does not—metadata access must also be available.