☰

KMSAccessDeniedException al leer mensajes de Amazon Kinesis

tag-icon • tag-icon encryption java streaming amazon-web-services
KMSAccessDeniedException al leer mensajes de Amazon Kinesis

He estado intentando consumir mensajes en una aplicación Java desde Kinesis Stream, la transmisión es propiedad de otra cuenta de AWS.

Cuando leo el mensaje, aparece el siguiente error:

com.amazonaws.services.kinesis.model.AmazonKinesisException: User ARTRIOONHGFA4UYTVBSF3:crossAccountTest is not authorized to decrypt records in stream 123456123456:stream-name:1234567890 (Service: AmazonKinesis; Status Code: 400; Error Code: KMSAccessDeniedException; Request ID: 00000000-0000-0000-0000-0000000000)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1579)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1249)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1030)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:742)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:716)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649)
 at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513)
 at com.amazonaws.services.kinesis.AmazonKinesisClient.doInvoke(AmazonKinesisClient.java:1831)
 at com.amazonaws.services.kinesis.AmazonKinesisClient.invoke(AmazonKinesisClient.java:1807)
 at com.amazonaws.services.kinesis.AmazonKinesisClient.getRecords(AmazonKinesisClient.java:912)
 at com.kafka.connect.KinesisSourceTask.poll(KinesisSourceTask.java:89)
 at org.apache.kafka.connect.runtime.WorkerSourceTask.poll(WorkerSourceTask.java:244)
 at org.apache.kafka.connect.runtime.WorkerSourceTask.execute(WorkerSourceTask.java:220)
 at org.apache.kafka.connect.runtime.WorkerTask.doRun(WorkerTask.java:175)
 at org.apache.kafka.connect.runtime.WorkerTask.run(WorkerTask.java:219)
 at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at java.lang.Thread.run(Thread.java:748)

Las funciones de IAM permiten el acceso a la transmisión y a la clave KMS utilizada para cifrar la transmisión. Intenté asumir el rol en la CLI y consumir mensajes desde allí, pero aparece el mismo mensaje de error. An error occurred (KMSAccessDeniedException) when calling the GetRecords operation: User ARTRIOONHGFA4UYTVBSF3:crossAccountTest is not authorized to decrypt records in stream 123456123456:stream-name:1234567890

Respuesta1

Descubrí que la clave KMS utilizada para cifrar la transmisión no tenía un Allowpermiso explícito que permitiera al rol asumido acceder a la clave.

Las políticas clave se actualizaron para incluir

{
            "Sid": "Allow use of the NDH Role Assuming Accessing the Kinesis Data Stream",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam:: 123456123456:role/assumed-role"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
                "arn:aws:kinesis:ap-southeast-2: 123456123456:stream/stream-name"
            ]
}

información relacionada