[aws-kinesis] Read permissions to stream don't include kinesis:DescribeStreamConsumer

[adrian-skybaker]

Currently granting read permissions to a Kinesis stream doesn't include sufficient permissions for consumers that use fan-out mode. Note that the KCL library uses fan-out out mode by default, you have to opt out of it.

As a result event after using stream.grantRead() you see errors like this in your consumer:

xxx is not authorized to perform: kinesis:DescribeStreamConsumer on resource: arn:aws:kinesis:ap-southeast-2:00000000:stream/my-application/consumer/my-consumer
xxx is not authorized to perform: kinesis:SubscribeToShard on resource: arn:aws:kinesis:ap-southeast-2:00000000:stream/application-logs-adrianbaker/consumer/my-application/consumer/my-consumer:1663667921

The required permissions are outlined at https://docs.aws.amazon.com/streams/latest/dev/tutorial-stock-data-kplkcl2-iam.html, the missing block that currently has to be added by hand is:

{
    "Sid": "Stmt234",
    "Effect": "Allow",
    "Action": [
      "kinesis:SubscribeToShard",
      "kinesis:DescribeStreamConsumer"
    ],
    "Resource": [
      "arn:aws:kinesis:us-west-2:123:stream/StockTradeStream/*"
    ]
},

Use Case

stream.grantRead() should allow a standard consumer using the KCL library with default settings to work without additional IAM policies.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.43.0

Environment details (OS name and version, etc.)

MS-DOS 6.x

[adrian-skybaker]

(edited to include missing kinesis:RegisterStreamConsumer permission)

edit my edit: kinesis:RegisterStreamConsumer is required on the stream itself (eg arn:aws:kinesis:us-west-2:123:stream/StockTradeStream), not the consumer resources underneath (eg `arn:aws:kinesis:us-west-2:123:stream/StockTradeStream/*).

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.