title: Windows Server no longer connecting to S3 via IAM role
body: <p>I have a Windows Server 2016 AMI (AMI v1) that was able to use an Instance Profile and associated IAM role to write to S3.</p>
  
  <p>That AMI was modified to enable Windows Remote Management (and a few other changes like replacing a EBS volume) and a new AMI was created (AMI v2).</p>
  
  <p>When using AMI v2 and Powershell commands like Write-S3Object, the following error is shown:</p>
  
  <pre><code>No credentials specified or obtained from persisted/shell defaults.
  </code></pre>
  
  <p>The Amazon SSM agent is also unable to start and it's error logs show: (note it works fine on AMI v1)</p>
  
  <pre><code>2017-10-09 14:53:13 ERROR [start @ agent.go.61] error occured when starting core manager: Failed to fetch region. Data from vault is empty. Get http://169.254.169.254/latest/dynamic/instance-identity/document: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  2017-10-09 14:53:13 ERROR [Execute @ agent_windows.go.169] Failed to start agent. Failed to fetch region. Data from vault is empty. Get http://169.254.169.254/latest/dynamic/instance-identity/document: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  2017-10-09 14:53:50 ERROR [NewCoreManager @ coremanager.go.63] error fetching the region, Failed to fetch region. Data from vault is empty. Get http://169.254.169.254/latest/dynamic/instance-identity/document: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
  </code></pre>
  
  <p>I've tried disabling Windows Remote Management, and Windows Firewall in AMI v2 and neither have helped.</p>
  
  <p>Any suggestions on how to debug this would be appreciated!</p>