AccessDenied about aws-maintenance HOT 9 CLOSED

I checked the IAM role and it looks fine:

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:DescribeDbSnapshots", "rds:CopyDbSnapshot", "rds:DeleteDbSnapshot", "rds:DeleteDbClusterSnapshot", "rds:DescribeDbClusters", "rds:DescribeDbClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": [ "*" ], "Effect": "Allow" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:*" ], "Effect": "Allow" }, { "Action": [ "kms:Create*", "kms:DescribeKey" ], "Resource": [ "arn:aws:kms:region:account:key/key_id" ], "Effect": "Allow" } ] }

from aws-maintenance.

Hi @crino85

That's interesting... did you modify the template or lambda in any way?
Are you using KMS encryption on the snapshots? Is the key_id in the role the correct key that's used to encrypt the TARGET snapshots (i.e. the copied snapshots in the target region)?

from aws-maintenance.

I'm not using any template. I copied the backup-rds.py file code in the lambda code. I only did the below changes:

SOURCE_REGION = os.environ.get('us-east-1') TARGET_REGION = os.environ.get('us-west-2') KMS_KEY_ID = os.environ.get('arn:aws:kms:us-west-2:<account_id>:key/<target_kms_id')

I also checked the IAM policy attached to the role which executes the lambda and it looks fine:

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:DescribeDbSnapshots", "rds:CopyDbSnapshot", "rds:DeleteDbSnapshot", "rds:DeleteDbClusterSnapshot", "rds:DescribeDbClusters", "rds:DescribeDbClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": [ "*" ], "Effect": "Allow" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:*" ], "Effect": "Allow" }, { "Action": [ "kms:Create*", "kms:DescribeKey" ], "Resource": [ "arn:aws:kms:us-west-2:<account_id>:key/<target_region_kms_key" ], "Effect": "Allow" } ] }

The thing is following the CloudFormation tutorial it worked fine but as I want to use Terraform I only wanted to have the Lambda function code. I cannot find where the error is...

Thanks,
Carlos

from aws-maintenance.

Also I don't like this in the step before failing:

Checking if 'swat-rds-prd-None-rds-swat-rds-prd-2020-04-06-02-04' exists in target region

is not taking the region and it puts None?

from aws-maintenance.

@crino85
The issue is in your modification here:

SOURCE_REGION = os.environ.get('us-east-1') 
TARGET_REGION = os.environ.get('us-west-2') 
KMS_KEY_ID = os.environ.get('arn:aws:kms:us-west-2:<account_id>:key/<target_kms_id')

os.envrion.get() is a python call to get an environment variable of the provided name. Since you're simply trying to provide a static value, you need just:

SOURCE_REGION = 'us-east-1'
TARGET_REGION = 'us-west-2'
KMS_KEY_ID = 'arn:aws:kms:us-west-2:<account_id>:key/<key_id>'

from aws-maintenance.

YEAH! You made my day! Thanks!

from aws-maintenance.

last question, would this approach also work for different AWS accounts but same region?

from aws-maintenance.

Yes, as long as the account ids and regions in IAM policy and Lambda settings are correct, it will work in any account in any region.

from aws-maintenance.

cool, thanks, I will test it!

from aws-maintenance.