measure-lambda-cold-starts: authorization failure

[nocquidant]

When I launch lumigo-cli measure-lambda-cold-starts, I get the following failure during the Loop step (from the web console):

$ lumigo-cli measure-lambda-cold-starts -n AwsSdkFn -r eu-west-1 -i 50

Neither the global service principal states.amazonaws.com, nor the regional one is authorized to assume the provided role.

It is not very clear to me, which role the error message is referring to...

FYI my company had setup an AWS "sandbox" account for all of its employees, based on Active Directory and the AWS Security Token Service. And there are a few restrictions attached to it (no account creation for instance). This is the account I am using. But the powerTuningStateMagine causes no problem, so I think it should be possible...

[nocquidant]

OK, it looks like the trust relationship for the state-machine execution role has the us region hard coded somewhere. If I edit it from the web console and change it for eu-west-1:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "states.eu-west-1.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Everything is fine.

[theburningmonk]

@nocquidant well spotted 👍 I'll get that fixed in here and it should fix itself in the lumigo-cli

[theburningmonk]

@nocquidant it should be fixed now, give me a shout if it still doesn't work for you.

[theburningmonk]

@nocquidant can you confirm this is no longer an issue for you? if so, I'll close the ticket

[nocquidant]

Yes the issue is resolved, thank you very much.