aws-samples / aws-samples/eks-workshop-v2

[Bug]: Lack of permission to create KMS Alias using Terraform

Open
#1,177 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
HCL
Stars
626
Forks
613
Avg merge
2d 7h
Merged PRs (30d)
9

Description

### Installation method

Own AWS account

### What happened?

When following the workshop guide to setup the environment with Terraform, the following error occurs:

```sh
Error: creating KMS Alias (alias/eks/eks-workshop): operation error KMS: CreateAlias, https response error StatusCode: 400, RequestID: 94f3be89-368d-4b98-9374-f4c4d511d56a, api error AccessDeniedException: User: arn:aws:sts::{account suppressed}:assumed-role/eks-workshop-ide-EksWorkshopIdeRole-LqlqA1nQsjV7/i-02d14764bdd1932b5 is not authorized to perform: kms:CreateAlias on resource: arn:aws:kms:us-west-2:{account suppressed}:alias/eks/eks-workshop because no identity-based policy allows the kms:CreateAlias action

with module.eks.module.kms.aws_kms_alias.this["cluster"],
on .terraform/modules/eks.kms/main.tf line 452, in resource "aws_kms_alias" "this":
452: resource "aws_kms_alias" "this" {

```

### What did you expect to happen?

The terraform module shoud create all resources without errors.

### How can we reproduce it?

Just try to setup the environment as described in https://eksworkshop.com/docs/introduction/setup/your-account/using-terraform

### Anything else we need to know?

The problem can be addressed manually by modifying permissions policies for the role eks-workshop-ide-EksWorkshopIdeRole-{hash}. Just change the inline policy eks-workshop-ide-base to allow action "kms:CreateAlias". After that, perform the `terraform apply` once more.

```
Terraform will perform the following actions:

# module.eks.module.kms.aws_kms_alias.this["cluster"] will be created
+ resource "aws_kms_alias" "this" {
+ arn = (known after apply)
+ id = (known after apply)
+ name = "alias/eks/eks-workshop"
+ name_prefix = (known after apply)
+ target_key_arn = (known after apply)
+ target_key_id = "22940659-c8e0-4964-84b3-546fd00d7aff"
}

Plan: 1 to add, 0 to change, 0 to destroy.
module.eks.module.kms.aws_kms_alias.this["cluster"]: Creating...
module.eks.module.kms.aws_kms_alias.this["cluster"]: Creation complete after 1s [id=alias/eks/eks-workshop]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
```

This issue seams to be related to https://github.com/aws-samples/eks-workshop-v2/issues/1091

### EKS version

1.30

Contributor guide

Open the contributing guide

Research direction

Start with the Terraform setup guide linked in the issue and inspect how the eks-workshop-ide-base inline policy is defined for the eks-workshop-ide role. Reproduce the apply failure, then verify that the KMS alias is created without manually changing permissions and that Terraform completes successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, terraform
Domain
cloud, infrastructure, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.