title: Running on EC2 using an instance profile using Terraform
body: <p>I'm trying to run Terraform on an AWS EC2 instance, which is setup with an instance profile.  However, Terraform doesn't seem to be implicitly using the Instance Profile and as such, I'm getting an "access denied" error whenever it tries to access my S3 remote state.</p>
  
  <p>From the docs, I'm having trouble telling if, I am required to specify an AWS_METADATA_URL, or if there's anything else I'm explicitly required to do to make this work.</p>
  
  <p>Per the Terraform docs:</p>
  
  <blockquote>
    <p>EC2 Role If you're running Terraform from an EC2 instance with IAM
    Instance Profile using IAM Role, Terraform will just ask the metadata
    API endpoint for credentials.</p>
    
    <p>This is a preferred approach over any other when running in EC2 as you
    can avoid hard coding credentials. Instead these are leased on-the-fly
    by Terraform which reduces the chance of leakage.</p>
    
    <p>You can provide the custom metadata API endpoint via the
    AWS_METADATA_URL variable which expects the endpoint URL, including
    the version, and defaults to <a href="http://169.254.169.254:80/latest" rel="nofollow noreferrer">http://169.254.169.254:80/latest</a></p>
  </blockquote>
  
  <p>Here's an example of what I'm trying to run:</p>
  
  <pre><code># main.tf
  
  provider "aws" {
    region = "${var.region}"
  }
  
  terraform {
    backend "s3" {}
  }
  
  module "core" {
    // ....
  }
  
  
  # init .sh
  
  terraform init -force-copy -input=false \
          -backend-config="bucket=$TERRAFORM_STATE_BUCKET" \
          -backend-config="key=$ENVIRONMENT/$SERVICE" \
          -backend-config="region=$REGION" \
          -upgrade=true
  
  # AWS policy
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "",
              "Effect": "Allow",
              "Action": [
                  "s3:*"
              ],
              "Resource": [
                  "*"
              ]
          },
      ]
  }
  </code></pre>
  
  <h3>UPDATE</h3>
  
  <p>It seems the s3 list-objects command is failing in Terraform, though my policies should be allowing this to go through</p>
  
  <pre><code>-----------------------------------------------------
  2018/02/20 21:09:37 [DEBUG] [aws-sdk-go] DEBUG: Response s3/ListObjects Details:
  ---[ RESPONSE ]--------------------------------------
  HTTP/1.1 403 Forbidden
  Connection: close
  Transfer-Encoding: chunked
  Content-Type: application/xml
  Date: Tue, 20 Feb 2018 21:09:36 GMT
  Server: AmazonS3
  X-Amz-Id-2: OVK5E3d5R+Jgj3if5lxAXkwuERPZWsJNFJ7NeMYFbSrhQ/h4FfpV4z2mlgXFKT1Hg7lsqJ/jE6Q=
  X-Amz-Request-Id: FE6B77C5C74BCFFF
  
  
  -----------------------------------------------------
  2018/02/20 21:09:37 [DEBUG] [aws-sdk-go] &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;&lt;Code&gt;AccessDenied&lt;/Code&gt;&lt;Message&gt;Access Denied&lt;/Message&gt;&lt;RequestId&gt;FE6B77C5C74BCFFF&lt;/RequestId&gt;&lt;HostId&gt;OVK5E3d5R+Jgj3if5lxAXkwuERPZWsJNFJ7NeMYFbSrhQ/h4FfpV4z2mlgXFKT1Hg7lsqJ/jE6Q=&lt;/HostId&gt;&lt;/Error&gt;
  2018/02/20 21:09:37 [DEBUG] [aws-sdk-go] DEBUG: Validate Response s3/ListObjects failed, not retrying, error AccessDenied: Access Denied
      status code: 403, request id: FE6B77C5C74BCFFF, host id: OVK5E3d5R+Jgj3if5lxAXkwuERPZWsJNFJ7NeMYFbSrhQ/h4FfpV4z2mlgXFKT1Hg7lsqJ/jE6Q=
  2018/02/20 21:09:37 [DEBUG] plugin: waiting for all plugin processes to complete...
  [31mError inspecting state in "s3": AccessDenied: Access Denied
      status code: 403, request id: FE6B77C5C74BCFFF, host id: OVK5E3d5R+Jgj3if5lxAXkwuERPZWsJNFJ7NeMYFbSrhQ/h4FfpV4z2mlgXFKT1Hg7lsqJ/jE6Q=
  </code></pre>