Permissions incorrect in tutorial

[rrzadzki]

Environment information

System:
  OS: macOS 14.5
  CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
  Memory: 45.84 MB / 16.00 GB
  Shell: /bin/zsh
Binaries:
  Node: 18.16.0 - ~/.nvm/versions/node/v18.16.0/bin/node
  Yarn: 1.22.21 - ~/.nvm/versions/node/v18.16.0/bin/yarn
  npm: 9.6.6 - ~/.nvm/versions/node/v18.16.0/bin/npm
  pnpm: undefined - undefined
NPM Packages:
  @aws-amplify/backend: 1.0.4
  @aws-amplify/backend-cli: 1.1.1
  aws-amplify: 6.4.0
  aws-cdk: 2.149.0
  aws-cdk-lib: 2.149.0
  typescript: 5.5.3
AWS environment variables:
  AWS_STS_REGIONAL_ENDPOINTS = regional
  AWS_NODEJS_CONNECTION_REUSE_ENABLED = 1
  AWS_SDK_LOAD_CONFIG = 1
No CDK environment variables

Description

After following the first four steps of the tutorial here without issue:

https://docs.amplify.aws/react/start/account-setup/

Step 5 (bootstrapping) fails with the following error:

SSMCredentialsError: AccessDeniedException: User: arn:aws:iam::547778446815:user/user-73e809b9-6617-49fa-8745-e922f5529d84 is not authorized to perform: ssm:GetParameter on resource: arn:aws:ssm:us-east-2:547778446815:parameter/cdk-bootstrap/hnb659fds/version because no identity-based policy allows the ssm:GetParameter action
Resolution: Make sure your AWS credentials are set up correctly and have permissions to call SSM:GetParameter
Cause: User: arn:aws:iam::547778446815:user/user-73e809b9-6617-49fa-8745-e922f5529d84 is not authorized to perform: ssm:GetParameter on resource: arn:aws:ssm:us-east-2:547778446815:parameter/cdk-bootstrap/hnb659fds/version because no identity-based policy allows the ssm:GetParameter action

Result is consistent whether using the "automatic" or "manual" steps for user creation.

[rrzadzki]

I resolved this for myself, although I don't yet totally understand why.

The operative step seemed to be not doing this:

"Make sure to set the profile name to default". When I followed that instruction, I was getting the SSMCredentialsError. For reference, my ~/.aws/config looked like this.

[default]
region = us-east-2
sso_session = amplify-session
sso_account_id = xxxxxxxxxxx
sso_role_name = amplify-policy
[sso-session amplify-session]
sso_start_url = https://xxxxxxxxxxx.awsapps.com/start
sso_region = us-east-2
sso_registration_scopes = sso:account:access

As I flailed in confusion, I thought "why not set a non-default name and specify it to see what that looks like." When I specified another name in the same step, amplify-default, and then passed this in the sandbox command: npx ampx sandbox --profile amplify-default, the error disappeared and everything worked. At this point, my ~/.aws/config looks like this:

[profile amplify-default]
sso_session = amplify-session
sso_account_id = xxxxxxxxxxx
sso_role_name = amplify-policy
region = us-east-2
[sso-session amplify-session]
sso_start_url = https://xxxxxxxxxxx.awsapps.com/start
sso_region = us-east-2
sso_registration_scopes = sso:account:access

I notice that, in the document, the first line of this file reads [profile default] where mine reads simply [default], whereas when I specified another name, profile is included there. Is this significant?? I do not know; I am merely pointing at things when I see them.

[ykethan]

Hey @rrzadzkim, thank you for reaching out. According to the documentation, the default profile does support [default] without the profile prefix.
Was there a default profile configure on the PC before? As If there are credentials in both files for a profile sharing the same name, the keys in the credentials file take precedence.

[rrzadzki]

I don't believe there was a profile on the system before this. If you can advise me on steps to completely clean the system of relevant configs, I'm happy to do a test.

[ykethan]

Hey @rrzadzki, the ~/.aws/config and ~/.aws/credentials should be the config files sandbox utilizes. But as the error is occurring on a the cdk bootstrap stack and the new profile configuration mitigated the error, I dont believe you may run into this again.
But the SSO on Amplify sandbox depends on the ~/.aws/config file which contains a profile that is defined to use a session.
Closing this issue for now. but if you do rerun into this error, do let us know we would be happy in diving deeper.

[redas4]

I resolved this for myself, although I don't yet totally understand why.

The operative step seemed to be not doing this:

"Make sure to set the profile name to default". When I followed that instruction, I was getting the SSMCredentialsError. For reference, my ~/.aws/config looked like this.

[default]
region = us-east-2
sso_session = amplify-session
sso_account_id = xxxxxxxxxxx
sso_role_name = amplify-policy
[sso-session amplify-session]
sso_start_url = https://xxxxxxxxxxx.awsapps.com/start
sso_region = us-east-2
sso_registration_scopes = sso:account:access

As I flailed in confusion, I thought "why not set a non-default name and specify it to see what that looks like." When I specified another name in the same step, amplify-default, and then passed this in the sandbox command: npx ampx sandbox --profile amplify-default, the error disappeared and everything worked. At this point, my ~/.aws/config looks like this:

[profile amplify-default]
sso_session = amplify-session
sso_account_id = xxxxxxxxxxx
sso_role_name = amplify-policy
region = us-east-2
[sso-session amplify-session]
sso_start_url = https://xxxxxxxxxxx.awsapps.com/start
sso_region = us-east-2
sso_registration_scopes = sso:account:access

I notice that, in the document, the first line of this file reads [profile default] where mine reads simply [default], whereas when I specified another name, profile is included there. Is this significant?? I do not know; I am merely pointing at things when I see them.

I had the same issue. This fix worked for me.

[markwatabe]

I also ran into the same issue, and the suggested fix also resolved it for me.

[romuloborges]

In case anyone is running into this same issue but the solution above is not working, I got it working by creating my Amplify user in IAM instead of IAM Identity Center. Then I configured a new profile with the generated access and secret keys and used it with the --profile option