(integ-tests-alpha): `ForbiddenException: UnknownError` when using `awsApiCall('IotData', 'publish', ...)`
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
`ForbiddenException: UnknownError` occurs when using `awsApiCall('IotData', 'publish', ...)`.
### Expected Behavior
Publish without error.
### Current Behavior
It causes a CFn error as following;
```
snstopicactiontestDefaultTestDeployAssert7CEC369B | 2/5 | 17:17:50 | CREATE_FAILED | Custom::DeployAssert@SdkCallIotDatapublish | sns-topic-action-test/DefaultTest/DeployAssert/AwsApiCallIotDatapublish0e02a766e2fbbaa9d608b52a8e174d10/Default/Default (AwsApiCallIotDatapublish0e02a766e2fbbaa9d608b52a8e174d10) Received response status [FAILED] from custom resource. Message returned: UnknownError (RequestId: 0274816b-6937-4120-9387-6a49a46d7085)
```
At this time, the following error occurs in Lambda;
```
2023-08-05T08:17:48.674Z af822d34-a72d-4a59-bdf2-b680dc4cde03 INFO ForbiddenException: UnknownError
at throwDefaultError (/var/runtime/node_modules/@aws-sdk/smithy-client/dist-cjs/default-error-handler.js:8:22)
at deserializeAws_restJson1PublishCommandError (/var/runtime/node_modules/@aws-sdk/client-iot-data-plane/dist-cjs/protocols/Aws_restJson1.js:473:51)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async /var/runtime/node_modules/@aws-sdk/middleware-serde/dist-cjs/deserializerMiddleware.js:7:24
at async /var/runtime/node_modules/@aws-sdk/middleware-signing/dist-cjs/middleware.js:13:20
at async StandardRetryStrategy.retry (/var/runtime/node_modules/@aws-sdk/middleware-retry/dist-cjs/StandardRetryStrategy.js:51:46)
at async /var/runtime/node_modules/@aws-sdk/middleware-logger/dist-cjs/loggerMiddleware.js:6:22
at async AwsApiCallHandler.processEvent (/var/task/index.js:31779:22)
at async AwsApiCallHandler.handle (/var/task/index.js:31459:26)
at async Runtime.handler (/var/task/index.js:31836:20) {
'$fault': 'client',
'$metadata': {
httpStatusCode: 403,
requestId: '43e28e61-c146-23b3-c37f-e452f61fc45b',
extendedRequestId: undefined,
cfId: undefined,
attempts: 1,
totalRetryDelay: 0
},
traceId: '43e28e61-c146-23b3-c37f-e452f61fc45b'
}
```
### Reproduction Steps
Use `IntegTest` as follofing;
```ts
const iotPublishCall = integ.assertions.awsApiCall('IotData', 'publish', {
topic: 'device/test-device-id/data',
});
```
### Possible Solution
It can be fixed changing the `prefix` of `IotData` in `sdk-api-metadata.json` to `iot` instead of `iot-data`.
https://github.com/aws/aws-cdk/blob/972a06f07e861fcd71b2ebb6ca72a72c97bda0d9/packages/@aws-cdk/integ-tests-alpha/lib/assertions/providers/sdk-api-metadata.json#L266
This json file is used for setting an action of a policy of CustomResource;
https://github.com/aws/aws-cdk/blob/c8258a6a6976da51e1096bef7e2e84bdc89a71c5/packages/@aws-cdk/integ-tests-alpha/lib/assertions/providers/provider.ts#L159-L172
From [the document](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-iot-data-plane/#client-commands-operations-list), all commands of `IotData` are below;
- DeleteThingShadow
- GetRetainedMessage
- GetThingShadow
- ListNamedShadowsForThing
- ListRetainedMessages
- Publish
- UpdateThingShadow
All policy actions of these command need `iot` prefix not `iot-data`. It can be confirmed with [this documentation](https://docs.aws.amazon.com/iot/latest/developerguide/iot-policy-actions.html).
### Additional Information/Context
_No response_
### CDK CLI Version
v2.90.0 (git hash `972a06f07e861fcd71b2ebb6ca72a72c97bda0d9`)
### Framework Version
_No response_
### Node.js Version
v20.4.0
### OS
mac m1
### Language
Typescript
### Language Version
v1.22.19
### Other information
_No response_
Contributor guide
Research direction
Start with packages/@aws-cdk/integ-tests-alpha/lib/assertions/providers/sdk-api-metadata.json near the IotData entry, then inspect provider.ts around lines 159-172 to see how policy actions are generated. Reproduce the integ assertion using awsApiCall('IotData', 'publish', ...); done means the generated policy permits the publish call and the assertion no longer fails with ForbiddenException.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, testing-qa
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100