aws-samples / aws-samples/eks-workshop-v2
[Bug]: Lack of permission to create KMS Alias using Terraform
- Dominant language
- HCL
- Stars
- 626
- Forks
- 613
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 9
Description
### Installation method
Own AWS account
### What happened?
When following the workshop guide to setup the environment with Terraform, the following error occurs:
```sh
Error: creating KMS Alias (alias/eks/eks-workshop): operation error KMS: CreateAlias, https response error StatusCode: 400, RequestID: 94f3be89-368d-4b98-9374-f4c4d511d56a, api error AccessDeniedException: User: arn:aws:sts::{account suppressed}:assumed-role/eks-workshop-ide-EksWorkshopIdeRole-LqlqA1nQsjV7/i-02d14764bdd1932b5 is not authorized to perform: kms:CreateAlias on resource: arn:aws:kms:us-west-2:{account suppressed}:alias/eks/eks-workshop because no identity-based policy allows the kms:CreateAlias action
with module.eks.module.kms.aws_kms_alias.this["cluster"],
on .terraform/modules/eks.kms/main.tf line 452, in resource "aws_kms_alias" "this":
452: resource "aws_kms_alias" "this" {
│
```
### What did you expect to happen?
The terraform module shoud create all resources without errors.
### How can we reproduce it?
Just try to setup the environment as described in https://eksworkshop.com/docs/introduction/setup/your-account/using-terraform
### Anything else we need to know?
The problem can be addressed manually by modifying permissions policies for the role eks-workshop-ide-EksWorkshopIdeRole-{hash}. Just change the inline policy eks-workshop-ide-base to allow action "kms:CreateAlias". After that, perform the `terraform apply` once more.
```
Terraform will perform the following actions:
# module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
+ resource "aws_kms_alias" "this" {
+ arn = (known after apply)
+ id = (known after apply)
+ name = "alias/eks/eks-workshop"
+ name_prefix = (known after apply)
+ target_key_arn = (known after apply)
+ target_key_id = "22940659-c8e0-4964-84b3-546fd00d7aff"
}
Plan: 1 to add, 0 to change, 0 to destroy.
module.eks.module.kms.aws_kms_alias.this["cluster"]: Creating...
module.eks.module.kms.aws_kms_alias.this["cluster"]: Creation complete after 1s [id=alias/eks/eks-workshop]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
```
This issue seams to be related to https://github.com/aws-samples/eks-workshop-v2/issues/1091
### EKS version
1.30
Contributor guide
Research direction
Start with the Terraform setup guide linked in the issue and inspect how the eks-workshop-ide-base inline policy is defined for the eks-workshop-ide role. Reproduce the apply failure, then verify that the KMS alias is created without manually changing permissions and that Terraform completes successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, terraform
- Domain
- cloud, infrastructure, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100