aws / aws/aws-panorama-cli

DescribePackage permission error not propagated up when running package-application

Open
#11 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
12
Forks
7
PR merge metrics
No merged PRs in 30d

Description

When running package-application, intending to update an existing package but the DescribePackage IAM permission is missing; the command will incorrectly try to create a package and will then error out with this message: `An error occurred (ConflictException) when calling the CreatePackage operation: {"resourceId":"XXXXXXX","message":"Package with same name exists.","resourceType":"Package"}`

I believe this is because of the check on the subprocess run call of describe-package in [package_application()](https://github.com/aws/aws-panorama-cli/blob/main/panoramacli/panorama-cli#L766), anything other than a successful call is treated as if the package doesn't exist when it might actually be another error (IAM permissions, network, etc)

```
#Check if the package already exists
status, output = execute(['aws panorama describe-package --output json --package-id packageName/' + package_name])
if status != 0: #Create new package if the package doesn't exist
```

The lack of visibility on the real error caused some confusion for me when when debugging a failing panorama application update. I think a good solution might be removing the shell commands altogether and using boto3 which has full(ish?) Panorama support now?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.