IAM role cannot access Neptune cluster even when rds:DescribeDBClusters is added to the policy
- Dominant language
- Java
- Stars
- 17
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
When executing neptune-export with a java project, IAM role of the ECS is not able to access the neptune cluster with the below error. I have attached the below policy to the IAM role but still see the same error. How do I set up neptune export to look for one specific cluster instead of cluster:*?
An error occurred while exporting from Neptune: User: arn:aws:sts::xxxxxxxxxx:assumed-role/ecs-task-v2/xxxxxxxxxx is not authorized to perform: rds:DescribeDBClusters on resource: arn:aws:rds:us-east-1:xxxxxxxxxx:cluster:* because no identity-based policy allows the rds:DescribeDBClusters action (Service: AmazonNeptune; Status Code: 403; Error Code: AccessDenied;
```
Policy: {
"Version": "",
"Statement": [
{
"Action": [
"rds:DescribeDBInstances",
"rds:ListTagsForResource"
],
"Effect": "Allow",
"Resource": [
"Arn:aws:rds:us-east-1:xxxxxxxxxx:db:neptune”
],
"Sid": "AllowSpecificRDS1"
},
{
"Action": [
"rds:DescribeDBClusters",
"rds:ListTagsForResource",
"rds:DescribeDBClusterParameters"
],
"Effect": "Allow",
"Resource": [
"arn:aws:rds:us-east-1:xxxxxxxxxxcluster:neptune-cluster"
],
"Sid": "AllowSpecificRDS2"
}
]
}
```
Contributor guide
Research direction
No source file or test is named. Start by reproducing neptune-export from the Java project with the shown ECS role and policy, then trace the cluster discovery request associated with rds:DescribeDBClusters. Done means the export can access the intended Neptune cluster without the reported 403.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- cloud, databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100