[aws-kinesis] Read permissions to stream doesn't include kinesis:DescribeStream #10783
Description
When granting an IAM role read permissions on a Kinesis stream, the resulting policy does not include the "kinesis:DescribeStream" permission, which is needed for at least Kinesis Firehose to read from it, perhaps other consumers as well.
Reproduction Steps
from aws_cdk import (
core,
aws_kinesis as kds,
aws_iam as iam,
)
class DFPStack(core.NestedStack):
def __init__(
self, scope: core.Construct, id: str, *, stream=kds.Stream, **kwargs
) -> None:
self.kfh_reader = iam.Role(
self,
"KFHReader",
assumed_by=iam.ServicePrincipal(service="firehose.amazonaws.com"),
)
self.stream = stream
self.stream.grant_read(self.kfh_reader)
Results in the following output:
"KFHReaderDefaultPolicy98F05724": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"kinesis:DescribeStreamSummary",
"kinesis:GetRecords",
"kinesis:GetShardIterator",
"kinesis:ListShards",
"kinesis:SubscribeToShard"
],
"Effect": "Allow",
"Resource": {
"Ref": "referencetoLongboatkinesisNestedStackkinesisNestedStackResourceFA86427BOutputsLongboatkinesisstreamDE86A4D8Arn"
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "KFHReaderDefaultPolicy98F05724",
"Roles": [
{
"Ref": "KFHReader8A09BD1B"
}
]
},
"Metadata": {
"aws:cdk:path": "Longboat/DFPStack/KFHReader/DefaultPolicy/Resource"
}
},
What did you expect to happen?
I expected the resulting IAM role and policy to actually be able to read from the supplied Kinesis stream when used by Kinesis Firehose. This would require the "kinesis:DescribeStream" permission to be given.
What actually happened?
Stack creation fails, because the "kinesis:DescribeStream" permission is lacking.
Cloudformation gives the following error:
Role arn:aws:iam::<account>:role/<role_name> is not authorized to perform: kinesis:DescribeStream on resource arn:aws:kinesis:eu-west-1:<account>:stream/<stream_name>. (Service: Firehose, Status Code: 400, Request ID: <request_id>, Extended Request ID: <extended_request_id>
Environment
- CLI Version: 1.66.0 (build 459488d)
- Framework Version: 1.66.0
- Node.js Version: v12.19.0
- OS: KDE Neon 5.19 (Ubuntu 20.04 focal)
- Language (Version): Python 3.8.5
Other
This is 🐛 Bug Report