I'm calling CreateConnectorProfile from a Lambda, and I get the following error :
An error occurred (ValidationException) when calling the CreateConnectorProfile operation: CreateConnectorProfile failed as AppFlow is unable to create secret in customer account {MyAWSAccountId}. Ensure the IAM user has permissions secretsmanager:CreateSecret and secretsManager:PutResourcePolicy. If customer managed KMS key was provided, ensure AppFlow also has access to the key. Please give the required permissions and try to create the connector profile again.
My Lambda's execution role has the Managed Policy AmazonAppFlowFullAccess
attached. The customer managed KMS Key (which is passed in as the kmsArn
to the CreateConnectorProfile call) has the following policy :
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "appflow.amazonaws.com"
},
"Action": [
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:Decrpyt"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::{MyAwsAccountId}:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}
What permissions am I missing?
I have the same issue but then through cloudformation, did you manage to get it working?