Create a resource fails with cloudwatch:PutMetricData error

[jeshan]

I've created and registered my first resource provider but I cannot create resources out of it. I'm seeing this in cfn and cloudwatch logs:

2019/12/29 11:32:19 Handler returned  OperationStatus: FAILED Message: Unable to complete request: ServiceInternal: Publisher error
caused by: ServiceInternal: Publisher error
caused by: AccessDenied: User: arn:aws:sts::607306539146:assumed-role/uluru-managed-execution-role/bb53badc-a2e5-df40-6809-0d6682b6a031 is not authorized to perform: cloudwatch:PutMetricData
    status code: 403, request id: b51ca0a1-b387-4c65-beb9-1cb56722ebc4 CallbackContext: map[] Delay: 0, ErrorCode: GENERALSERVICEEXCEPTION  

The handler code is fairly bare bone and I've even explicitly added the said permission to in my schema (redacted handler):

func Create(req handler.Request, prevModel *Model, currentModel *Model) (handler.ProgressEvent, error) {
    // Add your code here:
    // * Make API calls (use req.Session)
    // * Mutate the model
    // * Check/set any callback context (req.CallbackContext / response.CallbackContext)

    // Construct a new handler.ProgressEvent and return it
    response := handler.ProgressEvent{
        OperationStatus: handler.Success,
        Message: "Create complete",
        ResourceModel: currentModel,
    }

    return response, nil
}

I saw this cfn template got deployed via cfn submit -v in the stack ***-role-stack:

In the stack named CloudFormationManagedUploadInfrastructure, I see that the execution role has the following policy: Shouldn't that have been enough?

What's missing to fix this IAM issue?

[johnttompkins]

This issue seems to be related to the go plugin and some issues with the namespace to which we publish metrics. Once https://github.com/aws-cloudformation/cloudformation-cli-go-plugin/pull/108 is merged, create a new resource type version and try submitting.

[jeshan]

@jotompki I tried the above with very simple operations. Did custom providers ever work with the go plugin?

[rjlohan]

@jotompki I tried the above with very simple operations. Did custom providers ever work with the go plugin?

Yes we have a few setup but some changes to the backend may have introduced this failing condition related to metrics. Is the issue still present on the latest codebase?

[jeshan]

ok RJ, Not sure if I understood your question correctly; when I wrote that I tried the above, I was referring to my own code; not the PR #108 mentioned. I'm waiting for the PR to get merged to retry.

[rjlohan]

108 is merged so can you create a new version of your resource and republish to see if the issue is resolved?

[jeshan]

Looks much better, thanks. Should I close this issue or should it be tested in a proper release first?

[rjlohan]

I think we're good to close this now.

[pennywisdom]

Hi, I have been getting this issue or similar, I just retried after pushing my resource again but am still receiving the same issue with my resource type in eu-west-2. Do i need to update the plugin on my system or is this fix all at the backend?

Still receiving the following error in CF:

Unable to complete request: ServiceInternal: Publisher error caused by: ServiceInternal: Publisher error caused by: AccessDenied: User: arn:aws:sts::110951532853:assumed-role/uluru-managed-execution-role/4d506b61-7857-0d3e-d66d-1b479f76ce2c is not authorized to perform: cloudwatch:PutMetricData status code: 403, request id: 9247f70b-ae27-4e9e-8f70-1817dbd565a6

Thanks

[jeshan]

you need to update the plugin on your side to depend on "master"

On Tue, 7 Jan 2020 at 11:51, Alex Harrington notifications@github.com wrote:

Hi, I have been getting this issue or similar, I just retried after pushing my resource again but am still receiving the same issue with my resource type in eu-west-2. Do i need to update the plugin on my system or is this fix all at the backend? Thanks

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/aws-cloudformation/cloudformation-cli-go-plugin/issues/109?email_source=notifications&email_token=AAHZFFJBYM2QT5JBCKAKEWLQ4QYAJA5CNFSM4KCQLSA2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIIARFI#issuecomment-571476117, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAHZFFJH26BK7YVNLWDBM7LQ4QYAJANCNFSM4KCQLSAQ .

[pennywisdom]

Thanks @jeshan