And though I'm already passing --region us-gov-west-1, if I also export AWS_REGION=us-gov-west-1, I get a bit further. The IAM role is created, though no permissions are added to it.
The error is MalformedPolicyDocument: Partition "aws" is not valid for resource "arn:aws:logs:*:*:*"..
This is usually the case when an arn in a Gov Cloud region begins with arn:aws:... and not arn:aws-us-gov:...
json-templates/log-writer.json hard-codes the "Resource": "arn:aws:logs:*:*:*" line. Once I changed that to "Resource": "arn:aws-us-gov:logs:*:*:*", everything worked. So perhaps there can be some logic to toggle between different resources, depending on the region. As well as the strange behavior where --region passed on the command line is insufficient, and the AWS_REGION envvar is required.
aws-cn arn partition.
aws sts get-caller-identity, does it include the gov partition in the ARN result, or does it include the aws partition?
app.get('/myproc', async (req, res) => {
let tmp = await myhandler.myfunction();
res.status(200).send(tmp);
})
@Hunger_Artist_twitter I got it almost done... can you please check just one more thing for me. Do you have access to this policy:
aws iam get-policy --policy-arn 'arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole'if not, if there an equivalent policy in your partition?
@gojko This is pretty interesting. Running the command aws iam get-policy --policy-arn 'arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole' returns:
{
"Policy": {
"PolicyName": "AWSLambdaKinesisExecutionRole",
"PolicyId": "AN...",
"Arn": "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole",
"Path": "/service-role/",
"DefaultVersionId": "v2",
"AttachmentCount": 0,
"IsAttachable": true,
"Description": "Provides list and ead access to Kinesis streams and write permissions to CloudWatch logs.",
"CreateDate": "2017-05-08T18:26:34Z",
"UpdateDate": "2018-11-19T20:09:32Z"
}
}Running the above with --debug outputs the following request line:
2019-08-28 00:36:43,518 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=GetPolicy) (verify_ssl=True) with params: {'url_path': '/', 'query_string': '', 'method': 'POST', 'headers': {'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8', 'User-Agent': 'aws-cli/1.14.44 Python/3.6.8 Linux/4.15.0-1044-aws botocore/1.8.48'}, 'body': {'Action': 'GetPolicy', 'Version': '2010-05-08', 'PolicyArn': 'arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole'}, 'url': 'https://iam.us-gov.amazonaws.com/', 'context': {'client_region': 'aws-us-gov-global', 'client_config': <botocore.config.Config object at 0x7f7cc158e860>, 'has_streaming_input': False, 'auth_type': None}}So when the request is made to a us-gov AWS endpoint, even though the request has the aws partition, the response arn has the aws-us-gov partition.
Also - there's a typo in the Description response field.... could report to AWS
@gojko - Thanks, will try out that version before the end of the day (I'm in the eastern US timezone).
Does this version address the discrepancy between the AWS_REGION envvar and the --region command-line parameter mentioned here? :
:point_up: August 23, 2019 12:18 AM
Not sure if stackery requires CloudFormation.
I am using Claudia API Builder.
The endpoint that I created when hit 20 times at the same time produces the following error.
ThrottlingException: Rate exceededI basically have a for loop that loops over 20 times and in each loop it calls the Claudia API Endpoint.
I do not have throttling enabled for API Gateway so it should be like the following.Your current account level throttling rate is 10000 requests per second with a burst of 5000 requests
So I don't get why I get this error
