aws-cloudformation / aws-cloudformation/cloudformation-cli
AccessDenied when running cfn submit due to SCP
- Dominant language
- Python
- Stars
- 336
- Forks
- 172
- Avg merge
- 3d 5m
- Merged PRs (30d)
- 3
Description
The artifacts bucket created has a Deny for insecure transfer.
But the upload task does not use SSE.
The workaround for it is adding the ExtraArgs={'ServerSideEncryption': 'AES256'}
```
[2020-11-11T00:30:21Z] DEBUG - S3 upload resulted in unknown ClientError
Traceback (most recent call last):
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/upload.py", line 170, in upload
self.s3_client.upload_fileobj(fileobj, self.bucket_name, key)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/boto3/s3/inject.py", line 539, in upload_fileobj
return future.result()
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/futures.py", line 106, in result
return self._coordinator.result()
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/futures.py", line 265, in result
raise self._exception
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/tasks.py", line 126, in __call__
return self._execute_main(kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/tasks.py", line 150, in _execute_main
return_value = self._main(**kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/upload.py", line 692, in _main
client.put_object(Bucket=bucket, Key=key, Body=body, **extra_args)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/botocore/client.py", line 316, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/botocore/client.py", line 635, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
[2020-11-11T00:30:21Z] DEBUG - Caught downstream error
Traceback (most recent call last):
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/upload.py", line 170, in upload
self.s3_client.upload_fileobj(fileobj, self.bucket_name, key)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/boto3/s3/inject.py", line 539, in upload_fileobj
return future.result()
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/futures.py", line 106, in result
return self._coordinator.result()
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/futures.py", line 265, in result
raise self._exception
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/tasks.py", line 126, in __call__
return self._execute_main(kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/tasks.py", line 150, in _execute_main
return_value = self._main(**kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/upload.py", line 692, in _main
client.put_object(Bucket=bucket, Key=key, Body=body, **extra_args)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/botocore/client.py", line 316, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/botocore/client.py", line 635, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
```
The above exception was the direct cause of the following exception:
```
Traceback (most recent call last):
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/cli.py", line 100, in main
args.command(args)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/submit.py", line 21, in submit
args.set_default,
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/project.py", line 395, in submit
f, endpoint_url, region_name, role_arn, use_role, set_default
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/project.py", line 683, in _upload
s3_url = uploader.upload(self.hypenated_name, fileobj)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/upload.py", line 173, in upload
raise DownstreamError("Failed to upload artifacts to S3") from e
rpdk.core.exceptions.DownstreamError: Failed to upload artifacts to S3
```
Contributor guide
Assessment
This issue has not been assessed yet.