acusti
commented
2 years ago i just tried commenting out blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, and now i get an error due to specifying serverAccessLogsBucket when creating a bucket, e.g.:
const destination = new s3.Bucket(this, 'Destination', {
serverAccessLogsBucket: logsBucket,
serverAccessLogsPrefix: 'destination-bucket-logs/',
encryption: s3.BucketEncryption.S3_MANAGED,
publicReadAccess: false,
// blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
cors: [
{
maxAge: 3000,
allowedOrigins: ['*'],
allowedHeaders: ['*'],
allowedMethods: [s3.HttpMethods.GET],
},
],
});the error logs:
CREATE_FAILED Destination123AB456 AWS::S3::Bucket Thu Mar 24 2022 17:00:00 GMT-0700 (Pacific Daylight Time) API: s3:PutBucketLogging Access Deniedi also tried removing the SnsTopic Cfn.Output, but i still get the amplifyadmin is not authorized to perform: SNS:GetTopicAttributes error when running amplify push.
ykethan
Before opening, please confirm:
How did you install the Amplify CLI?
yarn
If applicable, what version of Node.js are you using?
v17.3.0
Amplify CLI Version
7.6.26
What operating system are you using?
Mac
Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No manual changes made
Amplify Categories
custom
Amplify Commands
push
Describe the bug
i am trying to add a custom CDK stack to my amplify app. in the
cdk-stack.tsfile, i am creating a few different S3 buckets. here’s an example of one of those:however, with that setup, when i try to deploy the stack using
amplify push, i see this error in the logs:it looks like this error is due to initializing the bucket with the
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALLoption, and it seems like the fix is just to add that action to the amplify IAM policy. the docs reference for the IAM policy states:however, i’m not sure how i’m supposed to update that policy. when i look in IAM in the console,
AdministratorAccess-Amplifypolicy is read-only because it is an AWS Managed Policy. is there some place in the docs that covers this? should this permission be a part of the main amplify IAM policy? i added a new policy that included that action and attached itamplify-useralongside theAdministratorAccess-Amplifypolicy, but i still get the same error on runningamplify push.an aside: the logs refer to
PutPublicAccessBlock, the S3 Actions API Reference includes it, but IAM doesn’t recognize it; instead, it has PutAccessPointPublicAccessBlock, PutAccountPublicAccessBlock, and PutBucketPublicAccessBlock. i’m guessing that PutBucketPublicAccessBlock is the action i need for my particular use case, but i’m not sure about that. i added all 3 permissions to the policy i created.i ran into two other access denied permissions issues while trying to deploy the custom stack. one is with creating a CloudFront instance; when i use
insertHttpSecurityHeaders: true, i get:lastly, adapting the scaffolded code to create a SNS topic and add an email subscription to it for my purposes, i get:
the only addition i made to the default code was to output the SNS topic:
Expected behavior
i expected to be able to
amplify pushmy custom CDK stack including S3 buckets, a CloudFront instance, and an SNS topic and subscription, without errors.Reproduction steps
in an existing amplify app, run
amplify add customgive it a name and choose CDK
add/uncomment
import * as s3 from '@aws-cdk/aws-s3';in cdk-stack.ts and add to the constructor:run
amplify pushmy code for creating the SNS topic and subscribing to it (where EMAIL ADDRESS HERE is an actual email address):
and for creating the CloudFront distribution connected to an S3 bucket (resulting in access denied due to missing
cloudfront:CreateFunctionpermission):GraphQL schema(s)
Log output
Additional information
No response