Help setting up aws acessing unauthorized access account for selling-partner-api

[dev-ravi-kas]

while setting up we are facing this error any one help.
AccessDeniedException: User: arn:aws:iam::858XXXXXXXXX:user/AmazonSpListing is not authorized to perform: secretsmanager:GetSecretValue on resource: settings because no identity-based policy allows the secretsmanager:GetSecretValue action

[jawheral]

Hi @dev-ravi-kas,

Thank you for reaching out!

Could you please provide which sample solution are you trying to deploy and at which step exactly are you receiving this error?

Best,
Jawher
Selling Partner Developer Services

[dev-ravi-kas]

Dear @jawheral,

Thank you for your prompt response.

We are currently setting up our local system and configuring our AWS account. However, when running the system, we encounter the following error message:

"User1XX is not authorized to perform: secretsmanager
on resource: settings because no identity-based policy allows the secretsmanager
action in cmd."

Could you please assist us in resolving this issue?

Best regards,
Ravi

[jawheral]

Hi @dev-ravi-kas,

The error you are sharing is due to missing permissions on your AWS IAM user policies.
Without more details on which sample solution you are deploying or what you are trying to accomplish exactly, which command you are running,... we won't be able to assist.

Best,
Jawher
Selling Partner Developer Services

[dev-ravi-kas]

Dear @jawher,

Thank you for your response.

Based on the error we encountered, it appears that the IAM user ApiUser1 does not have the necessary permissions to perform the secretsmanager:ListSecrets action. Currently, the user has permissions for creating, retrieving, and updating secrets, but listing secrets was not included in the policy.

To resolve this issue, we have updated the IAM policy for ApiUser1 to include the secretsmanager:ListSecrets permission. Below is the updated policy attached to the user:

json
Copy code
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "SettingsPersistencePermissions",
"Action": [
"secretsmanager:CreateSecret",
"secretsmanager:GetSecretValue",
"secretsmanager:PutSecretValue"
],
"Resource": "arn:aws:secretsmanager:us-east-1:858XXXXXXXXX:secret:settings*",
"Effect": "Allow"
},
{
"Sid": "NotificationsQueueManagementPermissions",
"Action": [
"sqs:CreateQueue",
"sqs:DeleteQueue"
],
"Resource": [
"arn:aws:sqs:us-east-1:858XXXXXXXXX:BrandedItemContentChangeQueue",
"arn:aws:sqs:us-east-1:858XXXXXXXXX:ItemProductTypeChangeQueue",
"arn:aws:sqs:us-east-1:858XXXXXXXXX:ListingsItemStatusChangeQueue",
"arn:aws:sqs:us-east-1:858XXXXXXXXX:ListingsItemIssuesChangeQueue",
"arn:aws:sqs:us-east-1:858XXXXXXXXX:ListingsItemMFNQuantityChangeQueue",
"arn:aws:sqs:us-east-1:858XXXXXXXXX:ProductTypeDefinitionsChangeQueue"
],
"Effect": "Allow"
},
{
"Sid": "NotificationsEventBusPermissions",
"Action": [
"events:CreateEventBus"
],
"Resource": "arn:aws:events:us-east-1:858XXXXXXXXX:event-bus/aws.partner/sellingpartnerapi.amazon.com/",
"Effect": "Allow"
},
{
"Sid": "NotificationsEventBusRulePermissions",
"Action": [
"events:PutRule",
"events:ListRules",
"events:ListTargetsByRule",
"events:PutTargets",
"events:RemoveTargets",
"events:DeleteRule"
],
"Resource": "arn:aws:events:us-east-1:858XXXXXXXXX:rule/aws.partner/sellingpartnerapi.amazon.com/",
"Effect": "Allow"
},
{
"Sid": "ListSecretsPermission",
"Action": [
"secretsmanager:ListSecrets"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
We have added the secretsmanager:ListSecrets permission to allow the user to list the secrets in AWS Secrets Manager.

Kindly let us know if any further adjustments are needed.

Best regards,
Ravi
Developer

[weilinggu]

Moved this discussion to issues which will be where Q&As should go. Closing this discussion for now.