Cross Account Authorization Error - AccessDeniedException

Hi,

I deployed the aws-sharr-deploy.template in “Main” account and also deployed the CISPermissions.template in the “member” account. I made sure to provide the correct account number of the main account when deploying to member account.

I’m getting the following error when running a cross account remediation and I really can’t figure out why. I checked the cross-account roles and the permissions seems to be correct.

ERROR "An error occurred (AccessDeniedException) when calling the StartAutomationExecution operation: User: arn:aws:sts::111111111111:assumed-role/SO0111_CIS4142_memberRole_us-west-2/sechub_master is not authorized to perform: ssm:StartAutomationExecution on resource: arn:aws:ssm:us-west-2::automation-definition/AWS-DisablePublicAccessForSecurityGroup:1"

[fuellbie]

I got the same error after installing the solution today (v1.2.0). I resolved it by manually replacing the account id by a wildcard in the automation-definition resource in the inline policy of the SO0111-SHARR-Remediation-AFSBP-EC2.2_us-east-1 role. The statement looks as follows:

        {
            "Action": [
Duplicate of #
                "ssm:StartAutomationExecution",
                "ssm:GetAutomationExecution"
            ],
            "Resource": [
                "arn:aws:ssm:eu-central-1:<accountid>:document/SO0111_Remediation_AFSBP_EC2.7",
                "arn:aws:ssm:eu-central-1:<accountid>:automation-definition/*",
                "arn:aws:ssm:eu-central-1:*:automation-definition/*",
                "arn:aws:ssm:eu-central-1:<accountid>:automation-execution/*"
            ],
            "Effect": "Allow"
        }

[mobri2a]

Update your stack (remove and replace) to v1.2.0, which was released recently. I haven’t seen this issue before, but best to get on the latest release first. Retry after the update and let us know if it’s working.