Misleading error message when creating an RDS DB Subnet Group in AWS

user_1008094 0
Viewed 711

I am using restricted roles for deploying resources via Cloudformation and have come across an error that threw me for a loop for some time.

I have a minimal role that I am using to create the resource. It only has the following allowed actions (On all resources)

rds:CreateDBSubnetGroup
ec2:DescribeVpcs
ec2:DescribeSubnets
ec2:DescribeAvailabilityZones

With the above actions, I am able to successfully create a DB Subnet Group with the following aws cli command:

aws rds create-db-subnet-group \
    --db-subnet-group-name testing \
    --db-subnet-group-description testing \
    --subnet-ids "subnet-abc" "subnet-def"

However, if I leave out any one of those ec2 actions, then I get a rather misleading error when running the same command.

An error occurred (InvalidParameterValue) when calling the CreateDBSubnetGroup operation: Missing necessary credentials. Please check http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.ServiceLinkedRoles.html

This threw me down a long rabbit-hole of looking at service linked roles, which made no difference (Adding the action iam:CreateServiceLinkedRole did not stop the error). I eventually found the ec2 actions to add via trial and error and looking at CloudTrail. The error about using RDS with IAM Service Linked roles was completely misleading.

My question really is... Is my assessment of this scenario accurate, or am I missing something fundamental here?

It would not be so bad if it were not for the fact that I then ran in to the same error when creating the DB instance. Naturally I no longer trusted this error, so did not look at service linked roles. Spent a day searching down that rabbit hole that led nowhere - only to find that in this instance it WAS the service linked roles (Easy fix).

amazon-iam amazon-rds amazon-web-services amazon-ec2
1 Answers

So, if you created an RDS database manually via the AWS console just to test, the service role would be created in the account on your behalf. The reason you were able to create the subnet manually, is because you were requesting it directly. When you create an rds instance and the subnet group is created for you (rds managed), the service linked role has to be present so RDS can create the subnet group on your behalf.

If you deploy rds into other AWS accounts with the same Cloudformation templates you will just have to rember to create a bogus RDS instance via the console first to get AWS to create the service linked role.

user_52125500
Related