Policy using resource: iam-policy recieves UnrecognizedClientException during dry-run in GovCloud #7610
Labels
Comments
|
which region specifically? this seems like an issue on the aws side, you probably want to inquire to aws support or your TAM. specifically we've already done the iam call, but then we're getting an error using the resource group tagging api with the same credentials. |
|
Us-gov-west-1. Is there a way to trace the calls made to AWS by cloud
custodian? It seems I don't even see a failed call in AWS/etc. in the
target account when this occurs.
…On Thu, Aug 4, 2022, 10:29 AM Kapil Thangavelu ***@***.***> wrote:
which region specifically? this seems like an issue on the aws side, you
probably want to inquire to aws support or your TAM. specifically we've
already done the iam call, but then we're getting an error using the
resource group tagging api with the same credentials.
—
Reply to this email directly, view it on GitHub
<#7610 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAOSFGVTXMENKLEO4KXHNADVXPHTJANCNFSM55SSQ32A>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
|
regarding seeing api calls, the easiest is probably via the builtin aws sdk instrumentation capabilities, ie. an alternative, you can optionally enable X-ray tracing via the cli (--trace xray) but given this is a failure scenario its not clear if that's viable here. |
|
i typically use https://vector.dev with csm as a sink/log of calls here's the config file i use for vector, and then i just set the AWS_CSM* env vars up. [sources.aws_csm]
type = "socket"
address = "127.0.0.1:31000"
max_length = 102_400
mode = "udp"
[transforms.parse]
type = "remap"
inputs = [ "aws_csm" ]
source = """
. = parse_json!(.message)
del(.SessionToken)
"""
[transforms.filter]
type = "filter"
inputs = ["parse"]
condition = '.Type != "ApiCallAttempt" && .Service != "SSO"'
[sinks.console]
inputs = ["filter"]
type = "console"
encoding = "json"
|
|
I also want to add my experience, as I see this issue, but only with govcloud regions. Running custodian version Having a policy as simple as what's below, returns the same
The same user can run |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
I'm receiving an when running the policy outlined below in dry-run mode. It seems to go in successfully when run without dry-run, but I'm not sure if they actual policy is working or not.
This is occuring in AWS GovCloud so the issue might be specific to GovCloud regions.
What did you expect to happen?
dry-run works successfully. Policy works.
Cloud Provider
Amazon Web Services (AWS)
Cloud Custodian version and dependency information
Custodian: 0.9.17 Python: 3.8.0 (default, Dec 9 2021, 17:53:27) [GCC 8.4.0] Platform: posix.uname_result(sysname='Linux', nodename='<removed>', release='4.15.0-2075-aws-fips', version='#80-Ubuntu SMP Tue Jun 14 01:57:31 UTC 2022', machine='x86_64') Using venv: True Docker: False Installed: argcomplete==2.0.0 attrs==21.4.0 boto3==1.24.10 botocore==1.27.10 docutils==0.17.1 importlib-metadata==4.11.4 importlib-resources==5.7.1 jmespath==1.0.0 jsonschema==4.6.0 pyrsistent==0.18.1 python-dateutil==2.8.2 pyyaml==6.0 s3transfer==0.6.0 six==1.16.0 tabulate==0.8.9 typing-extensions==4.2.0 urllib3==1.26.9 zipp==3.8.0Policy
- name: iam-policy-account-audit-policy resource: iam-policy description: | Cloud Custodian IAM Policy account:* Audit mode: type: periodic role: arn:aws-us-gov:iam::{account_id}:role/<removed> schedule: "rate(1 day)" filters: - type: has-allow-all - type: used actions: - type: notify template: default.html template_format: "html" priority_header: "5" subject: "Cloud Custodian - Security Audit: AWS IAM Policy HasAllowAll" to: - <email removed> transport: type: sqs queue: <sqs queue removed>Relevant log/traceback output
Extra information or context
No response
The text was updated successfully, but these errors were encountered: