aws-samples / iam-identity-center-team

Open-source temporary elevated access solution for AWS IAM Identity Center.
https://aws-samples.github.io/iam-identity-center-team/
MIT No Attribution
295 stars 67 forks source link

Intermittent issue || Not able see Requester's request when logged as Approver. #230

Closed banagevikas closed 2 months ago

banagevikas commented 5 months ago

Describe the bug We have implemented this for one of the customer 1 year back. It was working fine till end Feb. Since March users (who have access as Approvers) were reporting issue : they not able to see request when someone elevated access has been requested.

To Reproduce Since this is intermittent issue, not able to replicate easily Request for Elevated Access --> Check if Approver able to see request.

Expected behavior Approver Should able see request.

Screenshots

Requester Apprver-Screen

Analysis. I checked Cloudtrail logs and StepFunctions : I see that user request for Elevated access written in DynamoDB, also I can see one of the steps in Stepfunction in pending/waiting state as Approver needs to approve it. But since Approver not able to see request, he is not able to Approve it. So need help in debugging this issue.

flexelem commented 5 months ago

Not sure if it is the same but new requests are not showing up in the UI. requests dynamodb table has request items with empty email field which is probably the source of the problem about not seeing current requests.

tawoyinfa commented 5 months ago

@flexelem and @banagevikas what version are you on ?

flexelem commented 5 months ago

@tawoyinfa we are using 1.1 The issue went away when I removed all data from dynamo tables. But couldn't figure it out why emails were not getting persisted.

tawoyinfa commented 5 months ago

@flexelem is the issue resolved now ?

banagevikas commented 5 months ago

@tawoyinfa For us issue is still there. Regarding the version, any specific version you are looking for? If I check the version under path amplify > config > project-config.json, TEAMIDCAPP version is 3.1.

carlaabanes commented 4 months ago

facing this issue too... approver cannot see the requests.... I installed TEAM 1.1 what is the workaround for this @tawoyinfa ?

thank you.

banagevikas commented 4 months ago

@flexelem is the issue resolved now ?

nope :(

carlaabanes commented 4 months ago

For my case, this is not an issue anymore. I understand that a requestor cannot be the same person as the approver. Hence requestor cannot view his own requests for approval. This is by design. I have done further testing including different users making requests and as the approver, I can see their requests for approval when I log in.

banagevikas commented 4 months ago

In my case, requestor and approver are different. Any workaround guys ?

github-actions[bot] commented 2 months ago

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 7 days it will automatically be closed.