Users assuming roles should not have to use flag to bypass permssions check

[newrelic]

Users assuming roles should not have to use flag to bypass permssions check

[kolanos]

@prasket Thanks for reporting this. We've considered disabling the permissions check by default. However, simulate_principal_policy appears to support IAM roles, so this is likely a bug.

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.simulate_principal_policy

[metaskills]

Hi Ken here from Custom Ink. Was going to update our New Relic stuff today and I think I ran into this issue. We use assumed roles too. I myself even have MFA setup on my profile, but that should be transparent to all other CLI usage. After getting the "The following AWS permissions are needed to install the New RElic AWS Lambda integration:" error I tried passing the --no-aws-permissions-check flag as this issue suggested and found I am getting a different error(s).

MIX "Bad API Key or no API Key provided" and "Could not retrieve license key from New Relic. Check that your New Relic Account ID is valid and try again."

Traceback (most recent call last):
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/newrelic_lambda_cli/api.py", line 321, in retrieve_license_key
    return gql.get_license_key()
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/newrelic_lambda_cli/api.py", line 100, in get_license_key
    accountId=self.account_id,
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/newrelic_lambda_cli/api.py", line 48, in query
    gql(query), timeout=timeout, variable_values=variable_values or None
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/gql/client.py", line 78, in execute
    raise Exception(str(result.errors[0]))
Exception: {'message': 'Bad API Key or no API Key provided'}

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/core.py", line 782, in main
    rv = self.invoke(ctx)
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/core.py", line 1259, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/core.py", line 1259, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/core.py", line 1066, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/core.py", line 610, in invoke
    return callback(*args, **kwargs)
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/newrelic_lambda_cli/cli/integrations.py", line 94, in install
    nr_license_key = api.retrieve_license_key(gql_client)
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/newrelic_lambda_cli/api.py", line 326, in retrieve_license_key
    param="nr_account_id",
click.exceptions.BadParameter: Could not retrieve license key from New Relic. Check that your New Relic Account ID is valid and try again.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/newrelic-lambda-cli/.local/bin/newrelic-lambda", line 8, in <module>
    sys.exit(main())
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/newrelic_lambda_cli/utils.py", line 23, in _boto_error_wrapper
    return func(*args, **kwargs)
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/newrelic_lambda_cli/cli/__init__.py", line 27, in main
    cli()
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/core.py", line 829, in __call__
    return self.main(*args, **kwargs)
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/core.py", line 799, in main
    e.show()
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/exceptions.py", line 73, in show
    echo("Error: {}".format(self.format_message()), file=file, color=color)
  File "/home/newrelic-lambda-cli/.local/lib/python3.7/site-packages/click/exceptions.py", line 103, in format_message
    param_hint = self.param.get_error_hint(self.ctx)
AttributeError: 'str' object has no attribute 'get_error_hint'

However I can confirm that my NR API Key is correct by making a test request.

curl -X GET 'https://api.newrelic.com/v2/applications.json' \
  -H 'X-Api-Key:NRAA-asdfsafasdfsafsadfasdfsdf' -I

[kolanos]

@metaskills That is likely a separate issue from the one reported here. Can you verify your integrations are setup correctly in New Relic by following the steps here?
https://docs.newrelic.com/docs/integrations/amazon-integrations/get-started/connect-aws-infrastructure#connect

Specifically you'll want to verify your New Relic account and user in which your retrieving a license key for has the necessary permissions. For example, your New Relic user needs to be an owner, admin or an infra manager. Recommend contacting New Relic support for assistance.

[metaskills]

@kolanos Thanks. I an an admin on both sides. I did find out my core issue is that we already had our AWS Account connected going back last year. So I think I got two rounds of errors that took me in the wrong direction. Again, appreciate your help and I hope I did not detract for the issue presented here by @prasket

[kolanos]

Hi @prasket, we disabled the permissions check by default in: #115

Let us know if this didn't solve your issue. Thanks.