aws-cloudformation / aws-cloudformation/cloudformation-cli

AccessDenied when running cfn submit due to SCP

Aperta
#623 3 commenti 1 reazione 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
336
Fork
172
Merge medio
3g 5m
PR unite (30g)
3

Descrizione

The artifacts bucket created has a Deny for insecure transfer.
But the upload task does not use SSE.
The workaround for it is adding the ExtraArgs={'ServerSideEncryption': 'AES256'}
```
[2020-11-11T00:30:21Z] DEBUG - S3 upload resulted in unknown ClientError
Traceback (most recent call last):
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/upload.py", line 170, in upload
self.s3_client.upload_fileobj(fileobj, self.bucket_name, key)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/boto3/s3/inject.py", line 539, in upload_fileobj
return future.result()
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/futures.py", line 106, in result
return self._coordinator.result()
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/futures.py", line 265, in result
raise self._exception
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/tasks.py", line 126, in __call__
return self._execute_main(kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/tasks.py", line 150, in _execute_main
return_value = self._main(**kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/upload.py", line 692, in _main
client.put_object(Bucket=bucket, Key=key, Body=body, **extra_args)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/botocore/client.py", line 316, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/botocore/client.py", line 635, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
[2020-11-11T00:30:21Z] DEBUG - Caught downstream error
Traceback (most recent call last):
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/upload.py", line 170, in upload
self.s3_client.upload_fileobj(fileobj, self.bucket_name, key)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/boto3/s3/inject.py", line 539, in upload_fileobj
return future.result()
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/futures.py", line 106, in result
return self._coordinator.result()
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/futures.py", line 265, in result
raise self._exception
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/tasks.py", line 126, in __call__
return self._execute_main(kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/tasks.py", line 150, in _execute_main
return_value = self._main(**kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/s3transfer/upload.py", line 692, in _main
client.put_object(Bucket=bucket, Key=key, Body=body, **extra_args)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/botocore/client.py", line 316, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/botocore/client.py", line 635, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
```
The above exception was the direct cause of the following exception:
```
Traceback (most recent call last):
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/cli.py", line 100, in main
args.command(args)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/submit.py", line 21, in submit
args.set_default,
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/project.py", line 395, in submit
f, endpoint_url, region_name, role_arn, use_role, set_default
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/project.py", line 683, in _upload
s3_url = uploader.upload(self.hypenated_name, fileobj)
File "/root/.pyenv/versions/3.7.7/lib/python3.7/site-packages/rpdk/core/upload.py", line 173, in upload
raise DownstreamError("Failed to upload artifacts to S3") from e
rpdk.core.exceptions.DownstreamError: Failed to upload artifacts to S3
```

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Inizia in rpdk/core/upload.py, nel metodo upload e nella relativa chiamata boto3 a upload_fileobj mostrata nel traceback. Verifica come è configurato l’upload su S3 per il bucket degli artefatti. È completato quando cfn submit riesce a eseguire l’upload correttamente anche se il bucket nega i trasferimenti non sicuri, utilizzando l’impostazione ServerSideEncryption indicata.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
aws, python
Ambito
cloud
Tipo di issue
Bug
Difficoltà
2/5
Tempo stimato
1-3 ore
Stato di attività
Ferma
Chiarezza
Specificata chiaramente
Idoneità per principianti
35/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.