Skip to content
This repository has been archived by the owner on Jan 19, 2022. It is now read-only.

Readd elb permissions to ec2 host for aws-formula #216

Merged
merged 1 commit into from
Jul 5, 2016

Conversation

filipposc5
Copy link
Contributor

@filipposc5 filipposc5 commented Jul 5, 2016

Highstating with aws-formula currently produces this error:

[ERROR   ] 403 Forbidden
[ERROR   ] <ErrorResponse xmlns="http://elasticloadbalancing.amazonaws.com/doc/2012-06-01/">
  <Error>
    <Type>Sender</Type>
    <Code>AccessDenied</Code>
    <Message>User: arn:aws:sts::NNNNNNNNNNN:assumed-role/.. is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers</Message>
  </Error>
  <RequestId>ffa4bb0f-420e-11e6-a63b-e3fe5e66e8f5</RequestId>
</ErrorResponse>

[ERROR   ] Error getting ELB names: BotoServerError: 403 Forbidden
<ErrorResponse xmlns="http://elasticloadbalancing.amazonaws.com/doc/2012-06-01/">
  <Error>
    <Type>Sender</Type>
    <Code>AccessDenied</Code>
    <Message>User: arn:aws:sts::NNNNNNNNNNN:assumed-role/.. is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers</Message>
  </Error>
  <RequestId>ffa4bb0f-420e-11e6-a63b-e3fe5e66e8f5</RequestId>
</ErrorResponse>
Traceback (most recent call last):
  File "a", line 43, in get_elb_lbs
    all_lbs = [lb for lb in elb_connection.get_all_load_balancers()
  File "/usr/local/lib/python2.7/dist-packages/boto/ec2/elb/__init__.py", line 135, in get_all_load_balancers
    [('member', LoadBalancer)])
  File "/usr/local/lib/python2.7/dist-packages/boto/connection.py", line 1186, in get_list
    raise self.ResponseError(response.status, response.reason, body)
BotoServerError: BotoServerError: 403 Forbidden
<ErrorResponse xmlns="http://elasticloadbalancing.amazonaws.com/doc/2012-06-01/">
  <Error>
    <Type>Sender</Type>
    <Code>AccessDenied</Code>
    <Message>User: arn:aws:sts::NNNNNNNNNNN:assumed-role/.. is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers</Message>
  </Error>
  <RequestId>ffa4bb0f-420e-11e6-a63b-e3fe5e66e8f5</RequestId>
</ErrorResponse>

{'custom_grain_error': True}

This is due to:
06a185a

Adding access to just its own load balancer is not enough, because to query
(eg: Describe) it you have to already know and supply the resource name.
If no name is specified then a * is implied.

@filipposc5 filipposc5 force-pushed the fix-readd-loadbalancer-permissions branch 2 times, most recently from 85e0f00 to 5bedb05 Compare July 5, 2016 14:18
Highstating with aws-formula currently produces this error:

```
[ERROR   ] 403 Forbidden
[ERROR   ] <ErrorResponse xmlns="http://elasticloadbalancing.amazonaws.com/doc/2012-06-01/">
  <Error>
    <Type>Sender</Type>
    <Code>AccessDenied</Code>
    <Message>User: arn:aws:sts::NNNNNNNNNNN:assumed-role/.. is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers</Message>
  </Error>
  <RequestId>ffa4bb0f-420e-11e6-a63b-e3fe5e66e8f5</RequestId>
</ErrorResponse>

[ERROR   ] Error getting ELB names: BotoServerError: 403 Forbidden
<ErrorResponse xmlns="http://elasticloadbalancing.amazonaws.com/doc/2012-06-01/">
  <Error>
    <Type>Sender</Type>
    <Code>AccessDenied</Code>
    <Message>User: arn:aws:sts::NNNNNNNNNNN:assumed-role/.. is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers</Message>
  </Error>
  <RequestId>ffa4bb0f-420e-11e6-a63b-e3fe5e66e8f5</RequestId>
</ErrorResponse>
Traceback (most recent call last):
  File "a", line 43, in get_elb_lbs
    all_lbs = [lb for lb in elb_connection.get_all_load_balancers()
  File "/usr/local/lib/python2.7/dist-packages/boto/ec2/elb/__init__.py", line 135, in get_all_load_balancers
    [('member', LoadBalancer)])
  File "/usr/local/lib/python2.7/dist-packages/boto/connection.py", line 1186, in get_list
    raise self.ResponseError(response.status, response.reason, body)
BotoServerError: BotoServerError: 403 Forbidden
<ErrorResponse xmlns="http://elasticloadbalancing.amazonaws.com/doc/2012-06-01/">
  <Error>
    <Type>Sender</Type>
    <Code>AccessDenied</Code>
    <Message>User: arn:aws:sts::NNNNNNNNNNN:assumed-role/.. is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers</Message>
  </Error>
  <RequestId>ffa4bb0f-420e-11e6-a63b-e3fe5e66e8f5</RequestId>
</ErrorResponse>

{'custom_grain_error': True}
```

This is due to:
06a185a

Adding access to just its own load balancer is not enough, because to query
(eg: Describe) it you have to already know and supply the resource name.
If no name is specified then a `*` is implied.
@filipposc5
Copy link
Contributor Author

fixing tests hopefully

@filipposc5 filipposc5 force-pushed the fix-readd-loadbalancer-permissions branch from 5bedb05 to fcb2cc9 Compare July 5, 2016 14:45
@coveralls
Copy link

Coverage Status

Coverage decreased (-0.03%) to 51.458% when pulling fcb2cc9 on fix-readd-loadbalancer-permissions into 11b3fed on master.

@filipposc5 filipposc5 changed the title [WIP] Readd elb permissions to ec2 host for aws-formula Readd elb permissions to ec2 host for aws-formula Jul 5, 2016
@sevenmachines sevenmachines merged commit a4b9968 into master Jul 5, 2016
@filipposc5 filipposc5 deleted the fix-readd-loadbalancer-permissions branch July 5, 2016 21:56
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants