aws / aws/neptune-export

IAM role cannot access Neptune cluster even when rds:DescribeDBClusters is added to the policy

Open
#120 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
17
Forks
13
PR merge metrics
No merged PRs in 30d

Description

When executing neptune-export with a java project, IAM role of the ECS is not able to access the neptune cluster with the below error. I have attached the below policy to the IAM role but still see the same error. How do I set up neptune export to look for one specific cluster instead of cluster:*?

An error occurred while exporting from Neptune: User: arn:aws:sts::xxxxxxxxxx:assumed-role/ecs-task-v2/xxxxxxxxxx is not authorized to perform: rds:DescribeDBClusters on resource: arn:aws:rds:us-east-1:xxxxxxxxxx:cluster:* because no identity-based policy allows the rds:DescribeDBClusters action (Service: AmazonNeptune; Status Code: 403; Error Code: AccessDenied;

```
Policy: {
"Version": "",
"Statement": [
{
"Action": [
"rds:DescribeDBInstances",
"rds:ListTagsForResource"
],
"Effect": "Allow",
"Resource": [
"Arn:aws:rds:us-east-1:xxxxxxxxxx:db:neptune”
],
"Sid": "AllowSpecificRDS1"
},
{
"Action": [
"rds:DescribeDBClusters",
"rds:ListTagsForResource",
"rds:DescribeDBClusterParameters"
],
"Effect": "Allow",
"Resource": [
"arn:aws:rds:us-east-1:xxxxxxxxxxcluster:neptune-cluster"
],
"Sid": "AllowSpecificRDS2"
}
]
}
```

Contributor guide

Open the contributing guide

Research direction

No source file or test is named. Start by reproducing neptune-export from the Java project with the shown ECS role and policy, then trace the cluster discovery request associated with rds:DescribeDBClusters. Done means the export can access the intended Neptune cluster without the reported 403.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
cloud, databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.