Amplify CreateApp Permission

Question

My goal is to finish initialising amplify on my Xcode project with amplify init command. In process of initialising amplify after I choose profile I get an AccessDeniedException.

Here is the whole error:

init failed
AccessDeniedException: User: arn:aws:iam::214284559168:user/etiketa_admin is not authorized to perform: amplify:CreateApp on resource: arn:aws:amplify:eu-central-1:214284559168:apps/*
    at Object.extractError (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/protocol/json.js:51:27)
    at Request.extractError (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/protocol/rest_json.js:55:8)
    at Request.callListeners (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
    at Request.emit (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
    at Request.emit (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:683:14)
    at Request.transition (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:38:9)
    at Request.<anonymous> (/usr/local/lib/node_modules/@aws-amplify/cli/node_modules/aws-sdk/lib/request.js:685:12) {
  message: 'User: arn:aws:iam::214284559168:user/etiketa_admin is not authorized to perform: amplify:CreateApp on resource: arn:aws:amplify:eu-central-1:214284559168:apps/*',
  code: 'AccessDeniedException',
  time: 2020-01-14T13:09:16.321Z,
  requestId: '1b1d6217-4c88-43db-9028-51951519d1d8',
  statusCode: 403,
  retryable: false,
  retryDelay: 65.49222401684153
}

I know that I must set permission in IAM Management console for this user. But I'm not sure which permission is correct in order to get this working.

My question: What permission does user need to perform 'CreateApp on resource'?

score 16 · Accepted Answer · edited Jan 14 '20 at 20:06

You should set permission in IAM Management console for Amplify user. Below is Amplify CLI IAM policies for performing actions across all categories.

  {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "appsync:*",
                "apigateway:POST",
                "apigateway:DELETE",
                "apigateway:PATCH",
                "apigateway:PUT",
                "cloudformation:CreateStack",
                "cloudformation:CreateStackSet",
                "cloudformation:DeleteStack",
                "cloudformation:DeleteStackSet",
                "cloudformation:DescribeStackEvents",
                "cloudformation:DescribeStackResource",
                "cloudformation:DescribeStackResources",
                "cloudformation:DescribeStackSet",
                "cloudformation:DescribeStackSetOperation",
                "cloudformation:DescribeStacks",
                "cloudformation:UpdateStack",
                "cloudformation:UpdateStackSet",
                "cloudfront:CreateCloudFrontOriginAccessIdentity",
                "cloudfront:CreateDistribution",
                "cloudfront:DeleteCloudFrontOriginAccessIdentity",
                "cloudfront:DeleteDistribution",
                "cloudfront:GetCloudFrontOriginAccessIdentity",
                "cloudfront:GetCloudFrontOriginAccessIdentityConfig",
                "cloudfront:GetDistribution",
                "cloudfront:GetDistributionConfig",
                "cloudfront:TagResource",
                "cloudfront:UntagResource",
                "cloudfront:UpdateCloudFrontOriginAccessIdentity",
                "cloudfront:UpdateDistribution",
                "cognito-identity:CreateIdentityPool",
                "cognito-identity:DeleteIdentityPool",
                "cognito-identity:DescribeIdentity",
                "cognito-identity:DescribeIdentityPool",
                "cognito-identity:SetIdentityPoolRoles",
                "cognito-identity:UpdateIdentityPool",
                "cognito-idp:CreateUserPool",
                "cognito-idp:CreateUserPoolClient",
                "cognito-idp:DeleteUserPool",
                "cognito-idp:DeleteUserPoolClient",
                "cognito-idp:DescribeUserPool",
                "cognito-idp:UpdateUserPool",
                "cognito-idp:UpdateUserPoolClient",
                "dynamodb:CreateTable",
                "dynamodb:DeleteItem",
                "dynamodb:DeleteTable",
                "dynamodb:DescribeTable",
                "dynamodb:PutItem",
                "dynamodb:UpdateItem",
                "dynamodb:UpdateTable",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:GetRole",
                "iam:GetUser",
                "iam:PassRole",
                "iam:PutRolePolicy",
                "iam:UpdateRole",
                "lambda:AddPermission",
                "lambda:CreateFunction",
                "lambda:DeleteFunction",
                "lambda:GetFunction",
                "lambda:GetFunctionConfiguration",
                "lambda:InvokeAsync",
                "lambda:InvokeFunction",
                "lambda:RemovePermission",
                "lambda:UpdateFunctionCode",
                "lambda:UpdateFunctionConfiguration",
                "s3:*",
                "amplify:*"
            ],
            "Resource": "*"
        }
    ]
}

This JSON file is located on this link: IAM Policy for CLI

In order to get all required permissions for Amplify CLI you must create your own policy and copy this JSON to it. On how to create you own policy please refere to this link: Creating Policies on the JSON Tab

I know that I must set permissons in IAM Console. But my answer was which permission is the right one. Does `amplify:*` means that user must have all permissions or what. — lacefarin, Jan 14 '20 at 17:08
`amplify:*` means all required permissions just for amplify, also you need cloudformation,iam,labda...to work with amplify. for example, amplify needs appsync permission to create graphql api or lambda permision to create api getway — Alex, Jan 14 '20 at 17:15
https://aws-amplify.github.io/docs/cli-toolchain/usage?sdk=js#iam-policy-for-the-cli — Alex, Jan 14 '20 at 17:17
So to be clear, I made a group in IAM, then I add amplify user to this group. Now I must add the right policy to this group. I get things working if I set "AdministratorAccess" policy, which is obvious because user now has all permissions. But how can I add just specific policy and get this working. — lacefarin, Jan 14 '20 at 17:49
You don't need to use AdministratorAccess policy, just create a new policy and past above policy into Json section. — Alex, Jan 14 '20 at 18:05
This part was missing. I didn't know that you can create your own policy. Please make that clear in your answer and I will accept it. — lacefarin, Jan 14 '20 at 18:08
Wrote same json to create a new policy and added this permission to user but still getting the same error in Android. First I installed amplify CLI then I ran `amplify configure` and added permissions to that user and now on `amplify init` still getting the same error. — Feroz Khan, Mar 12 '20 at 07:39
Ah! my mistake, I was creating a user by using my IAM user account but it worked when I used the Administrator account for this. Thanks — Feroz Khan, Mar 12 '20 at 08:11

score 1 · Answer 2 · edited Nov 19 '20 at 14:29

Perhaps the above list is incomplete as I am unable to run amplify init using the above policies for the designated IAM user.

The amplify cli docs contain a comprehensive list of permissions that may be required for a complete setup. You may need to play around with them to see the minimum subset of permissions required for your needs.

(Posting as a separate answer because I am not allowed to comment on posts yet!)

Amplify CreateApp Permission

2 Answers2