10

I created a cloudformation stack with redshift cluster and a masteruser: testuser

"RedshiftCluster" : {
  "IamRoles" : [
      {
        "Fn::GetAtt": [
          "IAMInstanceRole",
          "Arn"
        ]
      }
    ]
  ... other configurations

It uses the below IAM role (IAMInstanceRole) which is in in-sync status and the redshift cluster is up and running:

"IAMInstanceRole": {
  "Properties": {
    "RoleName": "test-iam-role",
    "AssumeRolePolicyDocument": {
      "Statement": [
        {
          "Action": [
            "sts:AssumeRole"
          ],
          "Effect": "Allow",
          "Principal": {
            "Service": [
              "ec2.amazonaws.com",
              "redshift.amazonaws.com",
              "s3.amazonaws.com"
            ]
          }
        }
      ]
    },
    "Path": "/",
    "Policies": [ 
      {
      "PolicyName": "root",
        "PolicyDocument": {
          "Version" : "2012-10-17",
          "Statement": [ 
            {
              "Effect": "Allow",
              "Action": "*",
              "Resource": "*"
            }
          ]
        }
      } 
    ]
  }

I'm trying to load csv file from s3 to redshift using copy command and iam_role as credential. The iam_role has the arn of IAMInstanceRole (declared above). Whenever I execute the below command:

copy test_table from 's3://test-bucket/test.csv' CREDENTIALS 'aws_iam_role=arn:aws:iam::<account-id>:role/test-iam-role' MAXERROR 100000 removequotes TRIMBLANKS emptyasnull blanksasnull delimiter '|';

I get the error:

ERROR:  User arn:aws:redshift:us-west-2:189675173661:dbuser:automated-data-sanity-redshiftcluster-fbp9fgls6lri/sanityuser is not authorized to assume IAM Role arn:aws:iam::189675173661:role/sanity-test-iam-instance-role
DETAIL:




-----------------------------------------------
  error:  User arn:aws:redshift:us-west-2:<account-id>:dbuser:test-redshiftcluster-fbp9fgls6lri/testuser is not authorized to assume IAM Role arn:aws:iam::<account-id>:role/test-iam-role
  code:      8001
  context:   IAM Role=arn:aws:iam::<account-id>:role/test-iam-role
  query:     1139
  location:  xen_aws_credentials_mgr.cpp:236
  process:   padbmaster [pid=29280]
  -----------------------------------------------

Please suggest some resolution.

2
  • 1
    As John's answer defines, your assumerole document can not have more than 1 AWS service. Create separate IAM role for each service. Apr 1, 2018 at 13:31
  • I'm still getting the same error even after creating a separate redshift role could you please suggest what could possibly be wrong?
    – dr34m3r
    Apr 1, 2018 at 16:14

8 Answers 8

10

I ran into the same problem but after a good 1 hour of troubleshooting, I realised I had failed to add the Redshift role to the cluster while I was creating it. If you select the cluster from Redshift, choose the drop-down on 'Actions' and select 'Manage IAM roles' from there you will be able to attach the Redshift role you may have created for this cluster.

That solved the problem for me, anyways. Hope this helps.

5

I resolved this issue !! By default, IAM roles that are available to an Amazon Redshift cluster are available to all users on that cluster. You can choose to restrict IAM roles to specific Amazon Redshift database users on specific clusters or to specific regions.

To permit only specific database users to use an IAM role, take the following steps.

To identify specific database users with access to an IAM role

  1. Identify the Amazon Resource Name (ARN) for the database users in your Amazon Redshift cluster. The ARN for a database user is in the format: arn:aws:redshift:region:account-id:dbuser:cluster-name/user-name.

  2. Open the IAM Console at url="https://console.aws.amazon.com/.

  3. In the navigation pane, choose Roles.

  4. Choose the IAM role that you want to restrict to specific Amazon Redshift database users.

  5. Choose the Trust Relationships tab, and then choose Edit Trust Relationship. A new IAM role that allows Amazon Redshift to access other AWS services on your behalf has a trust relationship as follows:

{

  "Version": "2012-10-17",

  "Statement": [

    {
      "Effect": "Allow",
      "Principal": {
        "Service": "redshift.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}               
  1. Add a condition to the sts:AssumeRole action section of the trust relationship that limits the sts:ExternalId field to values that you specify. Include an ARN for each database user that you want to grant access to the role.

For example, the following trust relationship specifies that only database users user1 and user2 on cluster my-cluster in region us-west-2 have permission to use this IAM role.

{

  "Version": "2012-10-17",

  "Statement": [

  {

    "Effect": "Allow",
    "Principal": { 
      "Service": "redshift.amazonaws.com" 
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": [
          "arn:aws:redshift:us-west-2:123456789012:dbuser:my-cluster/user1",
          "arn:aws:redshift:us-west-2:123456789012:dbuser:my-cluster/user2"
        ]
      }
    }
  }]
}      

7.Choose Update Trust Policy.

2
2

Resolved it

Complete Steps followed :

  • Create s3 bucket in the same region as redshift ( move-redshift-data)
  • create a folder inside it. ( move-redshift-data)
  • create an IAM role (move-redshift-data-role) ,attach S3Fullaccesss and add the following to trust relationship

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::126111577039:root”
          },
          "Action": "sts:AssumeRole"
        }
      ]
    }
    

where 126111577039 is the account ID of redshift cluster

  • Find you already attached role to your cluster
    • Open your redshift cluster
    • Click on actions -->Manage IAM roles
    • You could see the role (mine is RedshiftDynamoDBAccess)
  • Open the role in IAM console and attach the following inline policy to it .

Add below policy to the role already associated to redshift cluster (See in manage cluster)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": "arn:aws:iam::888850378087:role/move-redshift-data-role"
        }
    ]
}

where 888850378087 : account which has s3 bucket in it and move-redshift-data role

  • Finally Run command

    unload ('select * from sellercompliancestate') 
    to 's3://unload-swarnimg/unload-swarnimg/'
    iam_role 'arn:aws:iam::126111577039:role/RedshiftDynamoDBAccess,arn:aws:iam::888850378087:role/move-redshift-data-role'
    allowoverwrite
    format as csv;
    
1

Here's a template that works fine:

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Resources": {
        "RedshiftRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "RoleName": "Redshift-Role",
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "redshift.amazonaws.com"
                                ]
                            },
                            "Action": [
                                "sts:AssumeRole"
                            ]
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "root",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": "s3:*",
                                    "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "RedshiftSG": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupName": "Redshift Security Group",
                "GroupDescription": "Enable access to redshift",
                "VpcId": "vpc-11223344",
                "SecurityGroupIngress": [
                    {
                        "IpProtocol": "tcp",
                        "FromPort": 5439,
                        "ToPort": 5439,
                        "CidrIp": "0.0.0.0/0"
                    }
                ],
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": "Redshift Security Group"
                    }
                ]
            }
        },
        "RedshiftCluster": {
            "Type": "AWS::Redshift::Cluster",
            "Properties": {
                "ClusterType": "single-node",
                "NodeType": "dc2.large",
                "MasterUsername": "master",
                "MasterUserPassword": "YourPassword",
                "IamRoles": [
                    {
                        "Fn::GetAtt": [
                            "RedshiftRole",
                            "Arn"
                        ]
                    }
                ],
                "VpcSecurityGroupIds": [
                    {
                        "Ref": "RedshiftSG"
                    }
                ],
                "PubliclyAccessible": true,
                "Port": 5439,
                "DBName": "foo"
            }
        }
    }
}

Be sure to insert your own VpcId in the security group.

The Role can be assumed by Redshift and grants access to s3:* (which you should reduce in scope).

3
  • I've created a separate redshift role as suggested, only my security group's SecurityGroupIngress is different: "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": "5439", "ToPort": "5439", "CidrIp": "10.1.0.0/16" }, { "IpProtocol": "tcp", "FromPort": "5439", "ToPort": "5439", "CidrIp": "52.89.255.224/27" } ] still I'm getting the same error as above
    – dr34m3r
    Apr 1, 2018 at 16:10
  • 2
    The "is not authorized to assume IAM Role" error is unreleated to Security Groups. You can go into the Redshift console and associate the cluster with the desired role, which should fix the error. Apr 1, 2018 at 21:21
  • The issue was with Security Tokens Region Service which I resolved using this thread: forums.aws.amazon.com/thread.jspa?messageID=782458&tstart=0, thanks for the help. I'll add this as answer.
    – dr34m3r
    Apr 2, 2018 at 6:52
1

I was trying to access Glue data catalog from Redshift. I created the role with the necessary policies attached (AWSGlueServiceRole, AmazonS3FullAccess), and added it to the cluster. However, I had set the AWS service as Glue but it should've been Redshift since Redshift is the service needing the access. Attaching these policies the Redshift role I have (and adding the role to the cluster, if necessary) solved the problem for me.

0

Got the solution after searching for a while. I created separate IAM role for redshift as John suggested, which is a correct advice but was not the issue in my case. Then followed the thread to resolve the issue: Copy from remote S3 using IAM Role - not authorized to assume IAM Role

I'd to activate the region where my cluster was in Account Settings

0

I solved by editing function like this

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "sagemaker.amazonaws.com", "redshift.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] }

I add "sagemaker.amazonaws.com" to my function AmazonRedshiftML

Function

-2

I figured it out.

There is no use of deleting a cluster, rebooting or managing IAM Roles in redshift Cluster.

Though I did all above many times, still I was getting the error. Then I tried below steps.

Give Access Key Id and secret Key in COPY command, instead of IAM role. Example as below.

copy users from 's3://awssampledbuswest2/tickit/allusers_pipe.txt' credentials 'aws_access_key_id=;SKDFHSJKD;aws_secret_access_key=SDJHFJHajhsdjh' delimiter '|' region 'us-west-2';

1
  • you should remove your aws_access_key_id and aws_secret_access_key and put in placeholders. Apr 10, 2020 at 2:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.