not authorized to perform: ssm:GetParametersByPath on arn:aws:ssm::parameter/<project name>

[atomraymaker]

I can't use an administrator role like I saw somewhere in the docs since I don't run the AWS account being deployed to We are able to deploy Serverless framework apps o the role has a few permissions. After I hit this error the permissions were updated with the below, which should cover this. I am wondering if the error is from not being able to access this specific parameter (which doesn't exist), where does this parameter come from?

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:Describe*",
"ssm:Get*",
"ssm:List*"
],
"Resource": "*"
}
]
}

[ryanblock]

I’m sorry; I’m not really sure what to do with this, you are welcome to use any permissions you want but our documentation is, I hope, clear about what Architect needs and why. Please see: https://arc.codes/docs/en/get-started/detailed-aws-setup#credentials

[atomraymaker]

I am not in the position to choose what permissions the deployment role has. I can convince someone to add a few permissions that may be missing, if they aren't something they consider a security issue, but I am not going to get anywhere asking for AdministratorAccess.

I understand that the deployment role will need to add roles, and that there likely aren't any protections preventing those roles from being AdministratorAccess themselves but I don't have direct access into those accounts to manage the deployment role, and it wouldn't be looked on favorably if I created my own deployed user with AdministratorAccess. I may end up needing to look for a new job.

So I am stuck with working through any permission complaints and asking for each new permission to be added until it works. In this case the permission seems to be present and it looks like the error is that there is an ssm parameter missing from the account.

What would architect be trying to do during a deploy when it hits and issue like:

not authorized to perform: ssm:GetParametersByPath on arn:aws:ssm::parameter/<project name>

The role performing the task has ssm:Get* permission so I assume the. reason it is failing is due to the parameter not being present. Should it be present? Where does it come from?

I guess I am also just trying to understand what Architect does during deployment outside of Cloudformation stack actions. I saw the cli env option which I assume pushes up ssm params? Are these then referenced in the CF stack or are they pulled via the aws- sdk at some point?

[ryanblock]

If I had to guess, probably this: https://github.com/architect/deploy/blob/main/src/sam/bucket/index.js#L10-L13

[atomraymaker]

Some progress. Adding the bucket under @aws, and having the Get* permission has allow the stack to start creating.

[sam-albon-li]

We just upgraded to Architect v10 and came across a similar issue; for us this only happens with named deployments (--name), where the named deployment is attempting to access staging variables for an unnamed (default named?) app instead.

AccessDeniedException: User: arn:aws:sts::?:assumed-role/ProductQuantitativeAssessmentStaging29-Role-QMLMVDI98828/ProductQuantitativeAssessmentS-GetUserIdHTTPLambda-ARoBNRPgWeG6 is not authorized to perform: ssm:GetParametersByPath on resource: arn:aws:ssm:ca-central-1:?:parameter/ProductQuantitativeAssessmentStaging because no identity-based policy allows the ssm:GetParametersByPath action

[ryanblock]

Sorry, that is not a similar issue at all. These are completely different code paths doing different things with different sets of permissions.

[sam-albon-li]

Sorry @ryanblock; from the outside it appeared similar.