Comments (8)
I can take this @mcpeak. I'll send a pr by this weekend.
from repokid.
Awesome, thank you!
from repokid.
Hello,
Instructions regarding creating role and instance profile are not clear. I am assigning role to ec2 instance and got the following error
(repokid) [root@ip- repokid]# repokid display_role_cache 123456
Loaded config from /home/ec2-user/repokid/config.json
INFO:botocore.vendored.requests.packages.urllib3.connectionpool:Starting new HTTP connection (1): 169.254.169.254
INFO:botocore.vendored.requests.packages.urllib3.connectionpool:Starting new HTTP connection (1): 169.254.169.254
INFO:botocore.vendored.requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): sts.amazonaws.com
Traceback (most recent call last):
File "/root/.virtualenvs/repokid/bin/repokid", line 11, in
load_entry_point('repokid', 'console_scripts', 'repokid')()
File "/home/ec2-user/repokid/repokid/cli/repokid_cli.py", line 950, in main
dynamo_table = dynamo_get_or_create_table(**config['dynamo_db'])
File "/home/ec2-user/repokid/repokid/utils/dynamo.py", line 64, in dynamo_get_or_create_table
region=dynamo_config['region'])
File "/root/.virtualenvs/repokid/local/lib/python2.7/site-packages/cloudaux-1.2.0-py2.7.egg/cloudaux/aws/decorators.py", line 40, in decorated_function
raise e
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: Not authorized to perform sts:AssumeRole
from repokid.
OK, let's first find out which of these you're missing:
-
Role for Repokid instance (
RepokidInstanceProfile
) including a policy that allowssts:AssumeRole
toRepokidRole
in the target account -
RepokidRole
in target account, with a trust policy that allowsRepokidInstanceProfile
to assume it
If you tell me which of these isn't set up right we can tighten up the documentation.
from repokid.
Thank you that helped.
Also found this documentation if someone is looking for "similar" steps.
https://github.com/Netflix/security_monkey/blob/develop/docs/iam_aws.md
from repokid.
#46 would probably be exposed/fixed as part of this.
How about a docker image?
from repokid.
@adamdecaf I'd love a docker image!
from repokid.
I managed to get "almost" everything configured. When I run some basic repo commands, repokid doesn't find any results.
$ repokid display_role 123456789012 RepoKidTest-Role
NFO:botocore.credentials:Credentials found in config file: ~/.aws/config
2019-05-09 00:09:51,850 WARNING: Could not find role with name RepoKidTest-Role [in /home/vagrant/repokid/repokid/repokid/cli/repokid_cli.py:535]
WARNING:repokid:Could not find role with name RepoKidTest-Role
$ repokid find_roles_with_permissions "iam:ListInstanceProfiles" --output=myroles.json
There's nothing in myroles.json
I think the problem is my "aardvark_api_location" parameter in config.json?
from repokid.
Related Issues (20)
- TypeError: 'NoneType' object does not support item assignment HOT 2
- Not showing permissions for most roles HOT 9
- "LoggerAdapter" object has no attribute "warn" HOT 1
- Suggestion: Continue to cut releases instead of pulling from master branch HOT 2
- docutils version issue HOT 4
- permission shown for all roles HOT 2
- repokid not finding modules attributes on release 0.14.0 HOT 3
- TypeError: can't compare offset-naive and offset-aware datetimes HOT 5
- When running update_role_cache - cannot import name 'TableExistsWaiter' from 'mypy_boto3_dynamodb.paginator' HOT 8
- Getting KeyError: 'RoleName' while trying to remove permissions from a role
- Still maintained?
- Test coverage for Dynamo
- Pip install doesn't work HOT 2
- When rolling back, we should show which permissions got restored HOT 2
- Restore part of a role
- The table does not have the specified index: RoleName HOT 2
- KeyError: 'DisqualifiedBy' HOT 1
- ARN not found in Access Advisor HOT 5
- Support Sid based exclusion HOT 1
- Support Athena querying for CloudTrail data HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from repokid.