Join Log in
Score:0
avatar Server

AWS ssn "PutParameter" not authorized

us flag
Matthew Bailin

I am trying to set a JWT secret in AWS's "parameter store" but appear to be unauthorized to do so. I am using a lab account so there would be no way for me to get authorization, but I have been assured that extra authorization isn't needed.

When I enter this command:

matthewbailin@matthewbailin FSND-Deploy-Flask-App-to-Kubernetes-Using-EKS % aws ssm put-parameter --name JWT_SECRET --overwrite --value "YourJWTSecret" --type SecureString

I receive the following error:

An error occurred (AccessDeniedException) when calling the PutParameter operation: User: arn:aws:sts::582046681201:assumed-role/voclabs/user1870121=8576a980-51b8-11ec-b4ca-5f837f5e11ac is not authorized to perform: ssm:PutParameter on resource: arn:aws:ssm:us-east-2:582046681201:parameter/JWT_SECRET with an explicit deny in an identity-based policy

I believe I have set the permissions on the AWS role with this command:

aws iam put-role-policy --role-name UdacityFlaskDeployCBKubectlRole --policy-name eks-describe --policy-document file://./iam-role-policy

and also sent the permissions to Kubernetes with this command:

kubectl get -n kube-system configmap/aws-auth -o yaml > ./aws-auth-patch.yml

Please let me know what additional information you may need. Again, I appear to be unauthorized to perform the "PutParameter" command but have no idea why.

64
0 + 0
in flag
mdaniel
Hi Matthew Bailin welcome to SF. Your question is confusing, do you control the IAM Role and are asking why that deny rule exists? You have also shown a lot of commands but none of the actual IAM Policy documents nor the Role to which they're attached. We can't _guess_ what's in them. Please [edit your question](https://serverfault.com/posts/1096703/edit) and include those details, or whatever troubleshooting steps you've already taken. Good luck
0
Reply
us flag
Matthew Bailin
How can I send you the files? At any rate, the problem appeared to be that the account that I was using the role and permissions policy had an explicit deny that prevented me from using PutParameter. When I created a new account, I was able to use the command without issue.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.