PutAccountPolicy doesn't recognize RoleArn #8823
Assignees
Labels
bug
This issue is a bug.
closed-for-staleness
iam
p2
This is a standard priority issue
response-requested
Waiting on additional info and feedback. Will move to "closing-soon" in 7 days.
service-api
This issue is due to a problem in a service API, not the SDK implementation.
Comments
karmaniverous
added
bug
tim-finnigan
added
the
investigating
|
Thanks for reaching out. The put-account-policy command makes a request to the IAM PutAccountPolicy API. The error here is coming from the API, so it's not directly related to the CLI. But I think there's an issue with the command you're running. I'll try to highlight using a separate JSON file: Note that the accountid was missing in the {
"DestinationArn": "arn:aws:firehose:us-west-2:accoundid:deliverystream/streamname",
"FilterPattern": "{\"$.level\":\"audit\"}",
"RoleArn": "arn:aws:iam::accountid:role/rolename"
}When running the above command I do not see the error you reported. |
tim-finnigan
added
response-requested
|
Well I think we've clicked one step farther along here and thanks for that. I think at this point I am experiencing a permissions issue. Going to lay it out here in hopes you will help me troubleshoot further. This is the relevant permission on my target S3 bucket in account B: {
"Sid": "FirehoseAuditLogger",
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
},
"Action": [
"s3:AbortMultipartUpload",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:PutObject",
"s3:PutObjectAcl"
],
"Resource": [
"arn:aws:s3:::audit-log-bucket",
"arn:aws:s3:::audit-log-bucket/*"
]
}When I run the demo data test from the Firehose console (the Firehose destination is also in account B), the test records do indeed land in the bucket. The Trust Policy {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "logs.us-east-1.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}Permissions {
"Version": "2012-10-17",
"Statement": [
{
"Action": "firehose:*",
"Effect": "Allow",
"Resource": "arn:aws:firehose:us-east-1:ACCOUNT_B_ID:deliverystream/AuditLogs"
}
]
}Now if I run this command in the cloud console from Account A: aws logs put-account-policy \
--policy-name audit-logs \
--policy-document "{\"DestinationArn\": \"arn:aws:firehose:us-east-1:ACCOUNT_B_ID:deliverystream/AuditLogs\",\"FilterPattern\": \"{\\\"$.level:\\\"audit\\\"}\",\"RoleArn\": \"arn:aws:iam:us-east-1:ACCOUNT_A_ID:role/AuditLogger\"}" \
--policy-type SUBSCRIPTION_FILTER_POLICY... I get this error: The Firehose stream is definitely active, because it was able to deliver its own test messages and also it indicates an Active state. Any ideas? |
github-actions
bot
removed
the
response-requested
|
Hm, I'm not sure what is causing the issue here if your trust policies are valid and the stream is active. Could you share your debug logs (with any sensitive info redacted) by adding |
tim-finnigan
added
the
response-requested
|
I'm afraid this may not be super helpful... |
github-actions
bot
removed
the
response-requested
|
Thanks for following up. Did you follow the documentation here on setting up a role/permissions: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html#FirehoseExample ? |
tim-finnigan
added
the
response-requested
|
Reading through our exchange here I see I only shared the Terraform configuration for the local account (the one generating the logs) not the remote account (the one hosting the stream & archive bucket). Here's the remote account config: # FirehoseAuditLogger role.
resource "aws_iam_role" "firehose_audit_logger" {
name = "FirehoseAuditLogger"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Principal = {
Service = "firehose.amazonaws.com"
}
Action = "sts:AssumeRole"
# Use conditions to lock this down to audit logs from app accounts.
# Condition = {
# StringEquals = {
# "sts:ExternalId" = "222222222222"
# }
# }
}
]
})
}
# FirehoseAuditLogger role policy document.
data "aws_iam_policy_document" "firehose_audit_logger_role" {
statement {
effect = "Allow"
actions = [
"s3:AbortMultipartUpload",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:PutObject",
"s3:PutObjectAcl"
]
resources = [
"arn:aws:s3:::${aws_s3_bucket.master_audit_log.bucket}",
"arn:aws:s3:::${aws_s3_bucket.master_audit_log.bucket}/*"
]
}
statement {
effect = "Allow"
actions = ["logs:PutLogEvents"]
resources = ["*"]
}
}
# Attach FirehoseAuditLogger role policy document to role.
resource "aws_iam_role_policy" "firehose_audit_logger" {
role = aws_iam_role.firehose_audit_logger.name
policy = data.aws_iam_policy_document.firehose_audit_logger_role.json
}
# Create AuditLogsDelivery Firehose delivery stream.
resource "aws_kinesis_firehose_delivery_stream" "audit_logs" {
name = "AuditLogs"
destination = "extended_s3"
extended_s3_configuration {
role_arn = aws_iam_role.firehose_audit_logger.arn
bucket_arn = aws_s3_bucket.master_audit_log.arn
prefix = "logs/"
compression_format = "GZIP"
}
}To answer your question: I certainly believe I have adhered to the reference you shared, with the caveat that I implemented the resources with Terraform instead of the command line. Am I missing something obvious? |
github-actions
bot
removed
the
response-requested
|
Hm...I'm not sure what the issue is here. Have you tried reaching out to Terraform regarding this, or do you have any other updates on your need? Regarding the Firehose error, it seems like there are some subtle gotchas with setting the role permissions that people have reported on Stack Overflow in posts like the ones here and here, which may be helpful. |
tim-finnigan
added
the
response-requested
|
Greetings! It looks like this issue hasn’t been active in longer than five days. We encourage you to check if this is still an issue in the latest release. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or upvote with a reaction on the initial post to prevent automatic closure. If the issue is already closed, please feel free to open a new one. |
github-actions
bot
added
closing-soon
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
I am attempting to create an account-level CloudWatch subscription to direct logs to a Firehose delivery stream in another account. When I send the request to create the policy, I get an error indicating that
RoleArnis missing, even thoughRoleArnis configured.Expected Behavior
PutAccountPolicy should complete without error.
Current Behavior
I get:
Reproduction Steps
Run this CLI command (I ran it in the cloud console with Admin permissions just to eliminate any platform issues). Replace
REMOTE_ACCOUNT_IDwith some other account id. Don't know if the delivery stream hast to exist in the target account for this command, didn't get that far. But it DOES exist in my environment, along with (I think) all necessary cross-account permissions.aws logs put-account-policy \ --policy-name audit-logs \ --policy-document "{\"DestinationArn\":\"arn:aws:logs::REMOTE_ACCOUNT_ID:deliverystream/AuditLogs\",\"FilterPattern\":{\"$.level\":\"audit\"},\"RoleArn\":\"arn:aws:iam:::role/AuditLogger\"}" \ --policy-type SUBSCRIPTION_FILTER_POLICYPossible Solution
I think the CLI command is just failing to parse the input correctly.
Note that I get the same error in the cloud and on my desktop.
Additional Information/Context
Here's the Terraform for the local role referenced above. Terraform throws the same error, but I was able to validate (see above) that the error is coming from AWS not TF:
CLI version used
aws-cli/2.17.14 Python/3.11.9 Linux/6.1.96-102.177.amzn2023.x86_64 exec-env/CloudShell exe/x86_64.amzn.2023
Environment details (OS name and version, etc.)
AWS Cloud
The text was updated successfully, but these errors were encountered: