I am trying to write a lambda that listens for Parameter Store change events from CloudWatch and gets history data for the parameter by calling boto3.client('ssm').get_parameter_history(Name=event["name"],WithDecryption=True)
. This method fails with the message:
botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetParameterHistory operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: blah-blah-blah)
Below is what the lambda's execution role looks like:
{
"roleName": "myapp-paramstore-updates-webhook-role",
"policies": [
{
"document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "logs:CreateLogGroup",
"Resource": "arn:aws:logs:eu-west-1:000000000000:*"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:eu-west-1:000000000000:log-group:/aws/lambda/ssm-paramstore-updates-webhook:*"
]
}
]
},
"name": "LambdaBasicExeRole",
"type": "inline"
},
{
"document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"kms:DescribeKey",
"ssm:GetParameter"
],
"Resource": [
"arn:aws:kms:eu-west-1:000000000000:key/*",
"arn:aws:ssm:eu-west-1:000000000000:parameter/myorg/myteam/slack/webhooks/ssm-paramstore-updates-webhook",
"arn:aws:ssm:eu-west-1:000000000000:parameter/myorg/myteam/slack/webhooks/system-eventsupdates-webhook"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "ssm:GetParameterHistory",
"Resource": "arn:aws:ssm:*:*:parameter/*"
}
]
},
"name": "readonly-ssm-paramstore-updates-webhook",
"type": "inline"
}
],
"trustedEntities": [
"lambda.amazonaws.com"
]
}
Before I used ssm:GetParameterHistory
, there was ssm:DescribeParameters
, but I needed to get some version info, hence the change. Everything is in the same region, the lambda and the parameters.
What additional permissions do I need now and on what resource in order to fix this?