# Error while running vault operator init **URL:** \ **Category:** Vault\ **Created:** [December 7, 2020, 2:59pm UTC](https://discuss.hashicorp.com/t/error-while-running-vault-operator-init/18577 "2020-12-07T14:59:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![tejasrshetty](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tejasrshetty/32/15518_2.png) [@tejasrshetty](https://discuss.hashicorp.com/u/tejasrshetty)\ **Post date:** [December 7, 2020, 2:59pm UTC](https://discuss.hashicorp.com/t/error-while-running-vault-operator-init/18577/1 "2020-12-07T14:59:33Z")
I am getting an error when I run the command vault operator init The error I get is Error initializing: Error making API request. URL: PUT [https://127.0.0.1:8200/v1/sys/init](https://127.0.0.1:8200/v1/sys/init) Code: 400. Errors: - failed to initialize barrier: failed to persist keyring: AccessDenied: Access Denied status code: 403, I followed steps mentioned on this article: > **[Setting up Hashicorp Vault with aws](https://medium.com/tulcolabs/setting-up-hashicorp-vault-with-aws-5468074d87c3)** > > Managing credentials in software projects can be tough. You never want to expose sensitive data unintentionally. Anyone can make this… I can see that my vault service is running when I check the status using the systemctl command. However, the init command fails. ---
**Author:** ![jlj7](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jlj7/32/18330_2.png) [@jlj7](https://discuss.hashicorp.com/u/jlj7)\ **Post date:** [December 7, 2020, 3:14pm UTC](https://discuss.hashicorp.com/t/error-while-running-vault-operator-init/18577/2 "2020-12-07T15:14:00Z")
Welcome! 😀 I think we’re going to need a bit more info to get to the bottom of this. As a start, I would say that this tutorial is now more complex than it needs to be: if this is your first time working with Vault, you might want to consider using [one of the official HashiCorp packages](https://www.hashicorp.com/blog/announcing-the-hashicorp-linux-repository), instead of doing a manual installation. That said, I would say that that isn’t your problem. It’s likely that Vault doesn’t have the proper permissions to write to your S3 bucket. Can you share some of what `systemctl` / `journalctl` are showing as logged around the time of this error? And maybe your Vault configuration file (without the secrets)? ---
**Author:** ![tejasrshetty](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tejasrshetty/32/15518_2.png) [@tejasrshetty](https://discuss.hashicorp.com/u/tejasrshetty)\ **Post date:** [December 7, 2020, 3:47pm UTC](https://discuss.hashicorp.com/t/error-while-running-vault-operator-init/18577/3 "2020-12-07T15:47:39Z")
Thank you for your reply! I’ve attached the systemctl logs: ![systemctl logs](https://global.discourse-cdn.com/hashicorp/original/2X/c/c9ed67c1bc1e0d863da073cefcc7831e51c4b918.png) and here is my vault-config.hcl file listener “tcp” { address = “0.0.0.0:8200” tls\_cert\_file="/etc/vault.d/.ssl/server.crt" tls\_key\_file="/etc/vault.d/.ssl/server.key" } backend “s3” { bucket = “” region = “” } disable\_mlock=true Please let me know if something else is needed. I will check on the policies to the attached IAM role on the EC2 where I am running this. Do we also need to configure a bucket policy in this setup? ---
**Author:** ![Wolfsrudel](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/wolfsrudel/32/28465_2.png) [@Wolfsrudel](https://discuss.hashicorp.com/u/Wolfsrudel)\ **Post date:** [December 7, 2020, 7:24pm UTC](https://discuss.hashicorp.com/t/error-while-running-vault-operator-init/18577/4 "2020-12-07T19:24:24Z")
Found this one: > > > Enabling default S3 bucket encryption appears to break the S3 backend. > Environment: > Vault Version: Vault v0.10.1 ('756fdc4587350daf1c65b93647b2cc31a6f119cd') > Operating System/Architecture: Ubuntu 16.04 > Vault Config File: > storage "s3"... Btw: your `api_addr` is not set. 😉 ---
**Author:** ![tejasrshetty](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tejasrshetty/32/15518_2.png) [@tejasrshetty](https://discuss.hashicorp.com/u/tejasrshetty)\ **Post date:** [December 8, 2020, 7:50pm UTC](https://discuss.hashicorp.com/t/error-while-running-vault-operator-init/18577/5 "2020-12-08T19:50:08Z")
Thank you for your reply! So I have not set S3 with KMS. Its just a normal S3 bucket with default settings, nothing different. I checked the role attached to the EC2 instance and it has list and put object access to the given S3 bucket. I am new to Vault, so can you tell me about the api\_addr paramter actually. I looked up in the documentation but still do not have a clear understanding on what it should be set to. Can anyone please provide links or videos for the same? My use case is to setup vault so that I can store the keys that I use to encrypt data stored in S3. If anyone can provide links or videos to this as well that would be really helpful!