You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When running the steampipe-plugin-aws for perimeter security checks on AWS ECS, the following issues were observed:
1. Unexpected AWS permission errors:
• Despite granting AdministratorAccess to both the ECS task role and the target account role, errors such as RepositoryPolicyNotFoundException still occur.
• Running the same queries locally with AWS SSO does not face these issues, raising the question of whether additional resource-based policies are required for ECS that aren’t needed locally.
• Even resources that are not in use are incorrectly flagged with errors.
2. JSON export failure:
• When the AWS permission errors occur, exporting results to JSON crashes with the following error:
Error: invalid character ',' looking for beginning of value
• This suggests that the AWS permission error responses are not being properly handled, leading to corrupted JSON output.
• The issue closely resembles the problem mentioned in a related Powerpipe [issue #665]
(#665).
To reproduce
Deploy Steampipe on an AWS ECS task
Attempt to export the query results to JSON.
Expected behavior
• The AWS perimeter security checks should execute successfully without encountering permission errors when administrator permissions are granted.
• JSON export should not crash due to AWS permission errors but instead handle them gracefully.
Additional context
• Not an IAM issue: Administrator access was provided, and some data is successfully retrieved before the error occurs.
• Not a memory issue: The ECS task was run with sufficient resources (4vCPU 8GB RAM), ruling out resource constraints.
• Queries run successfully in a local environment using AWS SSO credentials, but fail on ECS with the same permissions.
• The errors are affecting all resources, even those that are not actively in use.
• ECS task is running in a private subnet with outbound access via a NAT gateway.
• JSON export crashes when permission errors occur, potentially due to improper handling of AWS API responses.
The text was updated successfully, but these errors were encountered:
Describe the bug
When running the steampipe-plugin-aws for perimeter security checks on AWS ECS, the following issues were observed:
1. Unexpected AWS permission errors:
• Despite granting AdministratorAccess to both the ECS task role and the target account role, errors such as RepositoryPolicyNotFoundException still occur.
• Running the same queries locally with AWS SSO does not face these issues, raising the question of whether additional resource-based policies are required for ECS that aren’t needed locally.
• Even resources that are not in use are incorrectly flagged with errors.
2. JSON export failure:
• When the AWS permission errors occur, exporting results to JSON crashes with the following error:
Error: invalid character ',' looking for beginning of value
• This suggests that the AWS permission error responses are not being properly handled, leading to corrupted JSON output.
• The issue closely resembles the problem mentioned in a related Powerpipe [issue #665]
(#665).
Powerpipe version (
powerpipe -v
)• Steampipe version: 1.0.1
• Powerpipe version: 1.0.1
• AWS plugin version: 1.5.0
• Mod-perimeter version: 1.0.1
To reproduce
Deploy Steampipe on an AWS ECS task
Attempt to export the query results to JSON.
Expected behavior
• The AWS perimeter security checks should execute successfully without encountering permission errors when administrator permissions are granted.
• JSON export should not crash due to AWS permission errors but instead handle them gracefully.
Additional context
• Not an IAM issue: Administrator access was provided, and some data is successfully retrieved before the error occurs.
• Not a memory issue: The ECS task was run with sufficient resources (4vCPU 8GB RAM), ruling out resource constraints.
• Queries run successfully in a local environment using AWS SSO credentials, but fail on ECS with the same permissions.
• The errors are affecting all resources, even those that are not actively in use.
• ECS task is running in a private subnet with outbound access via a NAT gateway.
• JSON export crashes when permission errors occur, potentially due to improper handling of AWS API responses.
The text was updated successfully, but these errors were encountered: