search

pkallos / winston-firehose

NodeJS module, winston logging transport which writes to AWS Firehose.
MIT License
13 stars 9 forks source link

AWS cross account log posting #24

Closed ragu-nathan closed 4 years ago

ragu-nathan commented 4 years ago

How to post logs in a stream from one AWS account to another account with using Role. I have given the required access to another account to post logs.

const transports = [];
if (config.firehose) transports.push(new Firehose({
        streamName: 'arn:aws:firehose:us-east-1:xxxxxxx:deliverystream/streamName',
    firehoseOptions: {
        region: 'us-east-1',
    },
}));

const logger = winston.createLogger({
    transports,
    format: winstonFormat,
});

But I'm getting the below error on posting. The source account name arn is appending to the stream name which is causing issue. UnhandledPromiseRejectionWarning: AccessDeniedException: User: arn:aws:sts::xxxxxxxx:assumed-role/nonprod-contentservice-role/i-instanceId is not authorized to perform: firehose:PutRecord on resource: arn:aws:firehose:us-east-1:xxxxxxxx:deliverystream/arn:aws:firehose:us-east-1:yyyyyyyyyy:deliverystream/es-cs at Request.extractError (/var/app/current/node_modules/aws-sdk/lib/protocol/json.js:51:27) at Request.callListeners (/var/app/current/node_modules/aws-sdk/lib/sequential_executor.js:106:20) at Request.emit (/var/app/current/node_modules/aws-sdk/lib/sequential_executor.js:78:10) at Request.emit (/var/app/current/node_modules/aws-sdk/lib/request.js:683:14) at Request.transition (/var/app/current/node_modules/aws-sdk/lib/request.js:22:10) at AcceptorStateMachine.runTo (/var/app/current/node_modules/aws-sdk/lib/state_machine.js:14:12) at /var/app/current/node_modules/aws-sdk/lib/state_machine.js:26:10 at Request.<anonymous> (/var/app/current/node_modules/aws-sdk/lib/request.js:38:9) at Request.<anonymous> (/var/app/current/node_modules/aws-sdk/lib/request.js:685:12) at Request.callListeners (/var/app/current/node_modules/aws-sdk/lib/sequential_executor.js:116:18)

Can anyone help me to resolve this?

pkallos commented 4 years ago

Hi @ragu-nathan .

Based on this message:

User: arn:aws:sts::xxxxxxxx:assumed-role/nonprod-contentservice-role/i-instanceId is not authorized to perform: firehose:PutRecord on resource: arn:aws:firehose:us-east-1:xxxxxxxx:deliverystream/arn:aws:firehose:us-east-1:yyyyyyyyyy:deliverystream/es-cs

This appears to be a plain old AWS IAM permissions error.

I have given the required access to another account to post logs.

I will not be helping by suggesting that you double-check that all the right permissions are granted, but firehose:PutRecord needs to be present and you test and use the IAM Policy Simulator to check. Good luck!