search

aws-samples / service-screener-v2

A tool for customers to evaluate their AWS service configurations based on AWS and community best practices and receive recommendations on potential improvements.
Apache License 2.0
160 stars 44 forks source link

AccessDeniedException occurs when using the "--mode api-full" option #117

Closed orangex2 closed 2 months ago

orangex2 commented 2 months ago

Setting python3 -m venv . source bin/activate python3 -m pip install --upgrade pip rm -rf service-screener-v2 git clone https://github.com/aws-samples/service-screener-v2.git cd service-screener-v2 pip install -r requirements.txt alias screener="python3 $(pwd)/main.py"

Command screener --regions ap-southeast-2 --mode api-full

Env Instance : AWS EC2 / t2.micro ( & Cloudshell ) AMI Name : al2023-ami-2023.4.20240611.0-kernel-6.1-x86_64

error log /// ... (IAM::Group) inspecting ext_worker ... (IAM::Group) inspecting gaming_team ... (IAM:Account) inspecting AccessDeniedException Account xxxxxxxxxxx is a linked account. Access to AWS Budgets is managed at the payer account level. COMPLETED -- IAM::us-east-1 (210.058s) PREPARING -- S3::ap-southeast-2 ... (S3Account) inspecting Public access configuration not set ... (S3Bucket) inspecting cf-templates-r26ao8rn452v-ap-southeast-2 COMPLETED -- S3::ap-southeast-2 (13.37s) [info] Empty CF stacked deleted successfully, name:ssv2-0f57208fe463 Total Resources scanned: 168.00 | No. Rules executed: 550.00 Time consumed (seconds): 224.797 Traceback (most recent call last): File "/home/ec2-user/service-screener-v2/main.py", line 293, in os.rename(src, dest) FileNotFoundError: [Errno 2] No such file or directory: '/home/ec2-user/service-screener-v2/__fork/all.csv' -> '/home/ec2-user/service-screener-v2/adminlte/aws/xxxxxxxxxxx/all.csv' //

It seems that when using the "--mode api-full" option, an AccessDeniedException occurs, and the file is not created. Are there any conditions that need to be met to use this option? The output in HTML format works well, but is there a difference in the process when outputting in JSON format?

kuettai commented 2 months ago

It shouldn't be different. The exception is just mean that the current IAM user/role that accessing cloud shell do not have the permission to access cost explorer related api. Will take a look in next 24 hours.

kuettai commented 2 months ago

Please test and let me know if issue persists.