AWS EC2 Image Builder Lifecyle Policy execution failed with authorized error

I have an EC2 Image Builder lifecycle policy that should keep on the most recent images, but I see that it constantly fails with an error when triggered:

Unable to describe attributes of ami-01efe7b0d3f5e27c1 by ec2:DescribeImageAttribute. Error: You are not authorized to perform this operation. User: arn:aws:sts::XXXX:assumed-role/AWSServiceRoleForImageBuilder/ImageBuilder is not authorized to perform: ec2:DescribeImageAttribute on resource: arn:aws:ec2:eu-central-1::image/ami-01efe7b0d3f5e27c1 because no identity-based policy allows the ec2:DescribeImageAttribute action.

Please advice, have no clue what might be wrong, I do have the managed AWSServiceRoleForImageBuilder role and it has all necessary permissions and is used in the lifecycle policy.

I had the same problem. I fixed it by creating my own role, which I use for both the pipeline and lifecycle policy.

Permissions:

• EC2ImageBuilderLifecycleExecutionPolicy

• EC2InstanceProfileForImageBuilder

• EC2InstanceProfileForImageBuilderECRContainerBuilds

• Inline:

   {
       "Sid": "LifecyclePolicyNeedsMorePermission",
       "Effect": "Allow",
       "Action": [
           "ec2:DescribeImageAttribute"
       ],
       "Resource": "*"
   }
  

Trust Relationship:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "imagebuilder.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}