1

I am using the Amazon nodejs/javascript client for dax and every time I send a query, I get this response (which I had to dig out of the code by inserting logging statements):

{ "time": 1517618635321, "code": null, "retryable": false, "requestId": null, "statusCode": -1, "_tubeInvalid": true, "waitForRecoveryBeforeRetrying": false, "codeSeq": [ 4, 23, 31, 34 ] }

The code sequence returned apparently isn't even one that the node module seems to understand, so I'm completely lost.

I suspected a VPC networking configuration problem or an IAM problem, but I've gone over both with a fine tooth comb good enough for delousing, and I still don't see it.

How do I decode this error message, find the logs on the dax cluster servers, or in some other way figure out how to learn what error is causing this?

Eli
  • 227
  • 1
  • 3
  • 11
  • I have dug into this further it may be the case that the dax server is rejecting the signed credentials passed to it during socket initialization. I can find no examples of what the 'credentials' or 'credentialsProvider' config values should be. Does anyone know? – Eli Feb 03 '18 at 03:17

1 Answers1

0

[4, 23, 31, 34] is PermissionDenied, so your hunch that it's a permission issue is correct (I'll make a note to fix the mapping so that's clearer).

Credentials can be provided as a AWS.Credentials object, but the recommended way is to get them from the EC2 instance metadata, which the AWS SDK and DAX client will do automatically. This requires that your EC2 instances have a service role giving them permission to access DAX. The easiest way is to create a new role in the console, for use from EC2, and attach the AmazonDynamoDBFullAccess policy to it. Then, any EC2 instances you launch with that role will be able to access your DAX cluster.

(As for why the error is a NoRouteException, the released version has an overly-broad exception handler that needs to be cleaned up.)

Jeff Hardy
  • 7,632
  • 24
  • 24
  • What about for a lambda running in the same VPC as the dax cluster, rather than an EC2 instance? Add the service role to the lambda? – Eli Feb 11 '18 at 19:22
  • I just double-checked the service role on the lambda, and it claims to have full access to DAX. @jeff-hardy, thanks for the guidance so far, but I'm still lost. – Eli Feb 11 '18 at 19:29
  • I appear to have sorted this out. I do agree with you that more focused error messages would be a nice addition to the exception handler. – Eli Feb 11 '18 at 22:32
  • @Eli what was the solution? – Tomas Dermisek Jan 10 '19 at 04:53