How to Fix 'Login Profile Not Found' When Resetting a Storage Console Password
Add console access to a storage account that was created without a password
Overview
Storage accounts can be created two ways: with API-only access (an access key and secret key, no password) or with full console access (a password in addition to the keys). An account created API-only has no login profile, which causes two related problems: the Storage Console's password reset sends no email, and the reseller Management Console's "Set new password" action fails with a login profile not found error. Both have the same fix: create a login profile for the account's root user.
Why does Forgot Password send no email?
The Storage Console's Forgot Password flow only works for a user that already has a login profile (a password). If the account was created API-only, there is no login profile yet, so there is no account to send a reset email to. The request does not return an error. It simply does nothing.
If you never received a Storage Console welcome email with a password, or you have only ever used the account's access key and secret key, this is the likely cause.
Why does "Set new password" fail with login profile not found?
Resellers managing a customer's storage account from the Impossible Cloud Management Console see a different symptom for the same root cause. Clicking Set new password on Update storage account returns:
/impossiblecloud.service.iam.v1beta2.UserService ... NOT_FOUND: login profile not found
Set new password updates an existing login profile. It cannot create one. If the account has never had a login profile, this action fails until one is created first.
Create a login profile for the root user
A storage account's root user is also an IAM user, so the standard IAM create-login-profile action creates a login profile for it. Run this using the account's own root access key and secret key (not a reseller or partner API key):
aws iam create-login-profile \
--user-name "root-user@yourdomain.com" \
--password "Str0ng!Pass" \
--endpoint-url https://iam.impossibleapi.net \
--region eu-central-2
Replace root-user@yourdomain.com with the account's root login email, and set --password to the password you want. The root user's IAM username is the account's contact email. The IAM endpoint is global, so any region value works.
The password you set here is active immediately. There is no forced reset-on-first-login step.
After the command succeeds, sign in at console.impossiblecloud.com using the Root User Login tab with that email and password.
What if the account has no access key yet?
You need an access key for the account before you can run create-login-profile, since the command must be signed with that account's own credentials. If the account was provisioned without any access key, contact your Impossible Cloud partner or open a support ticket to have one issued first.
What if create-login-profile returns EntityAlreadyExists or a 500 error?
This means the email address is already registered on a different Impossible Cloud account. Login emails must be unique across all accounts. Open a support ticket so we can resolve the conflict.