1

We have IAM policies in place that used to permit the roles to edit a security group rules

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:RevokeSecurityGroupIngress",
                "ec2:AuthorizeSecurityGroupIngress"
            ],
            "Resource": "arn:aws:ec2:eu-west-1:XXXXXXXXXXX:security-group/sg-XXXXXXXXXXX"
        }
    ]
}

Since yesterday these roles are blocked with this message:

you may be missing iam policies that allow DescribeSecurityGroupRules

I did my research and it comes from the AWS update described in this article but there is no indication that it might break policies and no indication either on what action is necessary to make the policy works again.

What could be the shorter change I have to do to fix this problem?

gsempe
  • 113
  • 3

1 Answers1

2

Found the solution: seems like the option DescribeSecurityGroupRules is not yet available through the IAM UI but you can manually add it via JSON editing.

Yes, the UI will say the option does not exist:

enter image description here

But if you save the policy, it will work.

This tweet has helped me: https://twitter.com/AWSSupport/status/1413285145663184897

Luiz
  • 136
  • 2