DMS Endpoint Connection Test Failed with Secret Manager

0

Test Endpoint failed: Application-Status: 1020912, Application-Message: Failed to retrieve secret. Unable to find Secrets Manager secret, Application-Detailed-Message: Unable to find AWS Secrets Manager secret Arn 'arn:aws:secretsmanager:<region>:<account>:secret:XXXXXXX' The secrets_manager get secret value failed: curlCode: 7, Couldn't connect to server Too many retries: curlCode: 7, Couldn't connect to server

Hi, I'm doing a DMS Endpoint connection test between Priavate VPCs. I'm fighting the above error.

I set it up as below.

  • VPC1: Replication instance
  • VPC2 : Mysql RDS (admin password with secret manager)
  • The VPC is on the same account.

I also created a SecretManager VPC Endpoint on VPC1,

and the IAM Role connected to the DMS endpoint... This role has the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "secretsmanager:GetSecretValue",
            "Resource": [
                "arn:aws:secretsmanager:<region>:<account>:secret:XXXXXXX",
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
            ],
            "Resource": "arn:aws:kms:<region>:<account>:key/*"
        }
    ]
}

Here is the role trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "dms.amazonaws.com",
                    "dms.<region>.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

but the connection is not possible.

If I test the endpoint connection without using SecretManager with the same user password value, it will connect well. What's the problem? Please help me.

  • I understand the absurd complexity--and actually appreciate it. What I'll never appreciate is AWS' horrific UX. Can't you run tests/errors BEFORE clicking submit? Can't AWS save migration projects & parameters as drafts prior to the 1,000 redirects? Can't AWS consolidate the process so that we're not chasing 10 tabs of configs...along with 10 tabs of re:Post articles? All at the low low starting price of ~$15/day. Insanity.

1 個回答
0

Hello,

By looking at the error this seems issue with secrete manager ARN. Are you certain that ARN is right.

Here is one of the blog and documentation, to validate you if you had followed the same, although policy seems right.

https://aws.amazon.com/blogs/database/manage-your-aws-dms-endpoint-credentials-with-aws-secrets-manager/

https://docs.aws.amazon.com/dms/latest/userguide/security_iam_secretsmanager.html

You also check manually if you are able to retrieve secrete using cli, just to be sure secreteARN is right.

Here is one link for your reference: https://aws.amazon.com/blogs/security/how-to-connect-to-aws-secrets-manager-service-within-a-virtual-private-cloud/

Thanks Jitender

AWS
已回答 1 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南