🐛 botocore.exceptions.ClientError: An error occurred (AccessDeniedException)

[ChristinaLast]

Steps taken

• install pyenv
• install python==3.9.0
• install poetry
• install local package
• run openaq-engine cohort-builder

  Traceback

  openaq-engine cohort-builder
  INFO:botocore.credentials:Found credentials from IAM Role: aws-elasticbeanstalk-ec2-role
  Traceback (most recent call last):
  File "/home/christina/openaq-engine/.venv/bin/openaq-engine", line 33, in <module>
  sys.exit(load_entry_point('openaq-engine', 'console_scripts', 'openaq-engine')())
  File "/home/christina/openaq-engine/.venv/lib/python3.9/site-packages/click/core.py", line 1130, in __call__
  return self.main(*args, **kwargs)
  File "/home/christina/openaq-engine/.venv/lib/python3.9/site-packages/click/core.py", line 1055, in main
  rv = self.invoke(ctx)
  File "/home/christina/openaq-engine/.venv/lib/python3.9/site-packages/click/core.py", line 1657, in invoke
  return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/christina/openaq-engine/.venv/lib/python3.9/site-packages/click/core.py", line 1404, in invoke
  return ctx.invoke(self.callback, **ctx.params)
  File "/home/christina/openaq-engine/.venv/lib/python3.9/site-packages/click/core.py", line 760, in invoke
  return __callback(*args, **kwargs)
  File "/home/christina/openaq-engine/openaq_engine/main.py", line 39, in cohort_builder
  train_validation_dict = time_splitter.execute()
  File "/home/christina/openaq-engine/openaq_engine/src/time_splitter.py", line 135, in execute
  end_date = self.create_end_date(params)
  File "/home/christina/openaq-engine/openaq_engine/src/time_splitter.py", line 41, in create_end_date
  response_query_result = self._build_response_from_aws(
  File "/home/christina/openaq-engine/openaq_engine/src/time_splitter.py", line 67, in _build_response_from_aws
  response_query_result = query_results(params, sql_query)
  File "/home/christina/openaq-engine/openaq_engine/src/utils/utils.py", line 51, in query_results
  response_query_execution_id = client.start_query_execution(
  File "/home/christina/openaq-engine/.venv/lib/python3.9/site-packages/botocore/client.py", line 495, in _api_call
  return self._make_api_call(operation_name, kwargs)
  File "/home/christina/openaq-engine/.venv/lib/python3.9/site-packages/botocore/client.py", line 914, in _make_api_call
  raise error_class(parsed_response, operation_name)
  botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the StartQueryExecution operation: User: arn:aws:sts::399143675412:assumed-role/aws-elasticbeanstalk-ec2-role/i-0dc4d322b5fe411f2 is not authorized to perform: athena:StartQueryExecution on resource: arn:aws:athena:us-east-1:399143675412:workgroup/primary because no identity-based policy allows the athena:StartQueryExecution action
  (openaq-engine-py3.9) [christina@ip-172-31-81-98 openaq_engine]$ 

[ChristinaLast]

I think i solved by giving aws-elasticbeanstalk-ec2-role this IAM policy https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AmazonAthenaFullAccess