If it is as simple as a permission problem, check out placing the CA pem file to one thing less restrictive like so: when you have proxy added for your ec2 machines and it really is in private subnet using a S3 vpc-endpoint attached. I was getting the exact same https://cruzttrpo.ziblogs.com/29295490/a-simple-key-for-iam997-unveiled