By using AWS re:Post, you agree to the Terms of Use

Questions tagged with AWS Database Migration Service

Sort by most recent

Browse through the questions and answers listed below or filter and sort to narrow down your results.

DMSStack-DMSRole-xxxx/dms-session-for-replication-engine is not authorized to perform: secretsmanager:GetSecretValue

I'm trying to test endpoint connection from DMS Replication Instance, DMS (3.4.7) RI instance (running in Acnt A) is attempting to get a secret from SecretsManager (running in Acnt B) using VPC Interface endpoint, but errors out with the following. Test Endpoint failed: Application-Status: 1020912, Application-Message: Failed to retrieve secret. Unable to find Secrets Manager secret, Application-Detailed-Message: Unable to find AWS Secrets Manager secret Arn 'arn:aws:secretsmanager:us-east-1:acntBbbbbb:secret:/dmsdemo/aaaaa-<erandomStrng>' The secrets_manager get secret value failed: User: arn:aws:sts::acntAaaaa:assumed-role/DMSStack-DMSRole-zzzzzzz/dms-session-for-replication-engine is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-1:acntBbbbbb:secret:/aaaaa-<randomStrng> because no session policy allows the secretsmanager:GetSecretValue action Not retriable error: <AccessDeniedException> User: arn:aws:sts::acntAaaaa:assumed-role/DMSStack-DMSRole-zzzzzzz/dms-session-for-replication-engine is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-1:acntBbbbbb:secret:/dmsdemo/aaaaa-<randomStrng>' because no session policy allows the secrets DMSRole { "Version": "2012-10-17", "Statement": [ { "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource": "arn:aws:secretsmanager:us-east-1:acntAaaaa:secret:/dmsdemo/aaaaa-<randomStrng>", "Effect": "Allow" }, { "Action": "kms:Decrypt", "Resource": "arn:aws:kms:us-east-1:acnt:key/ddddddddddd", "Effect": "Allow" } ] } Resource Policy on Secret { "Version" : "2012-10-17", "Statement" : [ { "Effect" : "Allow", "Principal" : { "AWS" : [ "arn:aws:iam::acntAaaaaa:root", "arn:aws:iam::acntBbbbbbb:root" ] }, "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource" : "*" } ] } Any thoughts on what was missing in permissions that is restricting the access to secret
0
answers
0
votes
6
views
asked a day ago

DMS migration from Aurora MySQL 5.6 to Aurora MySQL 5.7 on graviton

Hi there, I am having recurring issues migrating Aurora MySQL 5.6.10 on db.r5.large to Aurora MySQL 5.7.12 on db.r6g.large. I started by trying to replicate all schemas I had created, but this failed with an unknown error. I then broke this down into one schema per replication group, this also failed with an unknown error. I then turned on CloudWatch logging for all tasks. This worked other than one table repeatedly fails to replicate. If I use the mysql cli to drop or repair the table, mysql drops the connection! When I look at the table in phpmyadmin, it says 'unknown storage engine' and/or table in use. When I try to drop the schema using phpmyadmin, it logs me out straight away! I've waited a few minutes and now can log back in, and can see the schema has been dropped successfully. This looks like a bug in DMS creating the table, or in Aurora somehow locking the table and putting it into an inconsistent state. I've now resolved the issue and moved on, but the service team might want to be aware of this. The table schema is very simple: CREATE TABLE IF NOT EXISTS `lkcities` ( `state` varchar(2) DEFAULT NULL, `city` varchar(16) DEFAULT NULL, `country_id` varchar(2) NOT NULL, UNIQUE KEY `country_id` (`country_id`,`state`,`city`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8; -- -- Dumping data for table `lkcities` -- INSERT INTO `lkcities` (`state`, `city`, `country_id`) VALUES ('AK', 'Akhiok', 'US'), ('AK', 'Akiachak', 'US'), ('AK', 'Akiak', 'US'), ('AK', 'Akutan', 'US'), ('AK', 'Alakanuk', 'US'), ('AK', 'Aleknagik', 'US'), ('AK', 'Allakaket', 'US'), ('AK', 'Ambler', 'US'), ('AK', 'Anaktuvuk Pass', 'US'), ('AK', 'Anchorage', 'US'), etc ~25,705 rows.
1
answers
0
votes
15
views
asked 2 days ago
1
answers
0
votes
62
views
asked 7 days ago