awslabs / awslabs/aws-securityhub-multiaccount-scripts

AccessDenied when calling the AssumeRole operation

Open
#32 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
282
Forks
108
PR merge metrics
No merged PRs in 30d

Description

python enablesecurityhub.py --master_account MASTERACCOUNTID --assume_role ManageSecurityHub --enabled_regions ap-south-1 enable.csv
Enabling members in these regions: ['ap-south-1']
Assumed session for MASTERACCOUNT ID.
Error Processing Account MEMBERACCOUNTID
---------------------------------------------------------------
Failed Accounts
---------------------------------------------------------------
XXXXXXXXX:
ClientError(u'An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::MASTERACCOUNTID:assumed-role/ManageSecurityHubInstanceRole/i-0a8a33c4f573xxxxx is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::MEMBERACCOUNTID:role/ManageSecurityHub',)
---------------------------------------------------------------
Option 1 selected. [EC2 instance with enablesecurityhub]

Could see the same IAM roles in master account and member account. Ran CFT to create the roles and instance profile,policy. Not sure what am i missing here. Any assistance here please.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.