AccessDenied

[crino85]

Hello,

I'm getting the error below. Role has attached FullRDS rights.

Any idea?

13:08:02
START RequestId: a41934f6-9264-41f4-bd0c-cc2990538f3c Version: $LATEST

13:08:02
Latest snapshot found: 'rds:swat-rds-prd-2020-04-06-02-04' from 2020-04-06 02:04:32.297000+00:00

13:08:02
Checking if 'swat-rds-prd-None-rds-swat-rds-prd-2020-04-06-02-04' exists in target region

13:08:02
[ERROR] ClientError: An error occurred (AccessDenied) when calling the DescribeDBClusterSnapshots operation: Unknown Traceback (most recent call last): File "/var/task/lambda_function.py", line 237, in lambda_handler copy_latest_snapshot(account_id, cluster, True) File "/var/task/lambda_function.py", line 140, in copy_latest_snapshot print_encryption_info(source_snapshot_arn, is_aurora

13:08:02
END RequestId: a41934f6-9264-41f4-bd0c-cc2990538f3c

[crino85]

I checked the IAM role and it looks fine:

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:DescribeDbSnapshots", "rds:CopyDbSnapshot", "rds:DeleteDbSnapshot", "rds:DeleteDbClusterSnapshot", "rds:DescribeDbClusters", "rds:DescribeDbClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": [ "*" ], "Effect": "Allow" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:*" ], "Effect": "Allow" }, { "Action": [ "kms:Create*", "kms:DescribeKey" ], "Resource": [ "arn:aws:kms:region:account:key/key_id" ], "Effect": "Allow" } ] }

[pbudzon]

Hi @crino85

That's interesting... did you modify the template or lambda in any way?
Are you using KMS encryption on the snapshots? Is the key_id in the role the correct key that's used to encrypt the TARGET snapshots (i.e. the copied snapshots in the target region)?

[crino85]

I'm not using any template. I copied the backup-rds.py file code in the lambda code. I only did the below changes:

SOURCE_REGION = os.environ.get('us-east-1') TARGET_REGION = os.environ.get('us-west-2') KMS_KEY_ID = os.environ.get('arn:aws:kms:us-west-2:<account_id>:key/<target_kms_id')

I also checked the IAM policy attached to the role which executes the lambda and it looks fine:

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:DescribeDbSnapshots", "rds:CopyDbSnapshot", "rds:DeleteDbSnapshot", "rds:DeleteDbClusterSnapshot", "rds:DescribeDbClusters", "rds:DescribeDbClusterSnapshots", "rds:CopyDBClusterSnapshot" ], "Resource": [ "*" ], "Effect": "Allow" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:*" ], "Effect": "Allow" }, { "Action": [ "kms:Create*", "kms:DescribeKey" ], "Resource": [ "arn:aws:kms:us-west-2:<account_id>:key/<target_region_kms_key" ], "Effect": "Allow" } ] }

The thing is following the CloudFormation tutorial it worked fine but as I want to use Terraform I only wanted to have the Lambda function code. I cannot find where the error is...

Thanks,
Carlos

[crino85]

Also I don't like this in the step before failing:

Checking if 'swat-rds-prd-None-rds-swat-rds-prd-2020-04-06-02-04' exists in target region

is not taking the region and it puts None?

[pbudzon]

@crino85
The issue is in your modification here:

SOURCE_REGION = os.environ.get('us-east-1') 
TARGET_REGION = os.environ.get('us-west-2') 
KMS_KEY_ID = os.environ.get('arn:aws:kms:us-west-2:<account_id>:key/<target_kms_id')

os.envrion.get() is a python call to get an environment variable of the provided name. Since you're simply trying to provide a static value, you need just:

SOURCE_REGION = 'us-east-1'
TARGET_REGION = 'us-west-2'
KMS_KEY_ID = 'arn:aws:kms:us-west-2:<account_id>:key/<key_id>'

[crino85]

YEAH! You made my day! Thanks!

[crino85]

last question, would this approach also work for different AWS accounts but same region?

[pbudzon]

Yes, as long as the account ids and regions in IAM policy and Lambda settings are correct, it will work in any account in any region.

[crino85]

cool, thanks, I will test it!