artilleryio / artilleryio/chaos-lambda

Error upon deploying: AccessDeniedException: Cross-account pass role is not allowed.

Open
#29 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
290
Forks
26
PR merge metrics
No merged PRs in 30d

Description

Our accounts are setup via an organisational accounts, with no users directly in development accounts. This is a common practice. Users switch role to desired accounts.

Perhaps this is the reason when deploying in a development account.

```
chaos-lambda deploy -r arn:aws:iam::50000000:role/ChaosLambda-Accessrole
AWS_REGION not set, defaulting to eu-west-1
Something went wrong:
{ AccessDeniedException: Cross-account pass role is not allowed.
at Object.extractError (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/protocol/json.js:43:27)
at Request.extractError (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/protocol/rest_json.js:37:8)
at Request.callListeners (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/sequential_executor.js:105:20)
at Request.emit (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
at Request.emit (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/request.js:596:14)
at Request.transition (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/request.js:21:10)
at AcceptorStateMachine.runTo (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/state_machine.js:14:12)
at /usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/state_machine.js:26:10
at Request. (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/request.js:37:9)
at Request. (/usr/local/lib/node_modules/chaos-lambda/node_modules/aws-sdk/lib/request.js:598:12)
message: 'Cross-account pass role is not allowed.',
code: 'AccessDeniedException',
time: 2019-06-21T13:53:13.545Z,
requestId: 'e992148c-942b-11e9-9727-097a78ea9fd9',
statusCode: 403,
retryable: false,
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the documented `chaos-lambda deploy -r arn:aws:iam::50000000:role/ChaosLambda-Accessrole` command with AWS_REGION unset, then trace the deploy entry point and its AWS role handling. The issue provides no repository file or test location and does not define an expected result, so completion criteria need to be established for deployments from switched roles in development accounts.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.