From core-shared-services, the instance scheduler lambda with the role InstanceSchedulerLambdaFunctionPolicy/instance-scheduler-lambda-function will attempt to assume the role InstanceSchedulerAccess in the member account.
In addition, this error is not being tracked & logged in the lambda log. As such its hidden amongst the general unauthorised-api-alert errors and not flagged as an instance scheduler error.
Actual Behavior
For some accounts an AccessDenied error occurs. Note that this error is not logged in the lambda log & does not show as an error in the lambda metric.
Examples of cloudtrail ids in core-shared-services showing this error are:
3b012434-a836-453c-9e14-983c00a0a662
4af4ceab-c294-4ce7-9878-ccb881dd2035
552a5917-5a17-4aa3-8dfc-48c9c4cefe7f
Steps to Reproduce the Problem
These events can be found every morning & afternoon the instance scheduler runs.
Expected Behavior
From core-shared-services, the instance scheduler lambda with the role InstanceSchedulerLambdaFunctionPolicy/instance-scheduler-lambda-function will attempt to assume the role InstanceSchedulerAccess in the member account.
In addition, this error is not being tracked & logged in the lambda log. As such its hidden amongst the general unauthorised-api-alert errors and not flagged as an instance scheduler error.
Actual Behavior
For some accounts an AccessDenied error occurs. Note that this error is not logged in the lambda log & does not show as an error in the lambda metric.
Examples of cloudtrail ids in core-shared-services showing this error are:
3b012434-a836-453c-9e14-983c00a0a662
4af4ceab-c294-4ce7-9878-ccb881dd2035
552a5917-5a17-4aa3-8dfc-48c9c4cefe7f
Steps to Reproduce the Problem
These events can be found every morning & afternoon the instance scheduler runs.
Source code & module call can be found here - https://github.com/ministryofjustice/modernisation-platform/blob/11c18b77be7de8ad0e6c1cc574e70a9bc751417a/terraform/environments/core-shared-services/instance-scheduler-lambda-function.tf#L1
Version
No response
Modules
No response
Account
core-shared-services