[aws-elasticsearch] Elastic search domain resource lacks permissions.
See original GitHub issueElastic search domain resource lacks permissions.
Failed to create resource. Error in Accessing KmsKeyID with details:User: arn:aws:sts::<ID>:assumed-role/Testing-Mi-Main-Stack-<ID>-<ID>/Testing-Mi-Main-Stack-<ID>-<ID> is not authorized to perform: kms:DescribeKey on resource: arn:aws:kms:eu-central-1:<ID>:key/<ID> (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: <ID>; Proxy: null)
Reproduction Steps
Create elastic search Domain. (from aws_cdk.aws_elasticsearch import Domain).
What did you expect to happen?
Domain created.
What actually happened?
CloudFormation error complaining about permissions:
Failed to create resource. Error in Accessing KmsKeyID with details:User: arn:aws:sts::<ID>:assumed-role/Testing-Mi-Main-Stack-<ID>-<ID>/Testing-Mi-Main-Stack-<ID>-<ID> is not authorized to perform: kms:DescribeKey on resource: arn:aws:kms:eu-central-1:<ID>:key/<ID> (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: <ID>; Proxy: null)
Environment
- CDK CLI Version : 1.72.0
- Framework Version: 1.72.0
- Node.js Version: v15.1.0 -->
- OS : MacOS
- Language (Version): Python3.9
Other
The bug seems to be new. Did not experience in previous versions.
This is 🐛 Bug Report
Issue Analytics
- State:
- Created 3 years ago
- Reactions:1
- Comments:34 (24 by maintainers)
It seems that in some, still unknown, conditions, the
es:updateElasticsearchDomainConfig
invoked by theElasticsearchAccessPolicy
requires thekms:DescribeKey
permission on the key.I’m reluctant to add this by default while its still unclear, but to get around this issue you can add the necessary permissions like so:
@Ruben-E this still doesn’t explain why the same problem is happening in your case where only the L1 is being used.
@Ruben-E @ignaloidas @laimonassutkus managed to reproduce, thanks for all the cooperation 😃