This message was deleted.

sparse-intern-71089

11/21/2019, 4:43 PM

This message was deleted.

white-balloon-205

11/21/2019, 5:06 PM

From your notes - sounds like you indeed don’t have permission to read these files in S3 - and I would expect Pulumi needs to read them to list details of the stacks. I don’t know precisely what to suggest without seeing all the policies you have applied to these buckets - but it does not sound like there is anything particularly Pulumi specific here. Unfortunately, cross-account bucket policy configuration in AWS is frequently very confusing.

boundless-monkey-50243

11/21/2019, 5:11 PM

So typically in this situation one would apply a condition to the bucket policy that requires bucket-owner-full-control, but Pulumi barfs at that.

boundless-monkey-50243

11/21/2019, 5:12 PM

The bucket policies are just global access delegated to the sub-accounts. It seems to be an object-level problem.

white-balloon-205

11/21/2019, 6:04 PM

but Pulumi barfs at that

Are you saying that you can download the contents of a file with a set of credentials, but cannot see it with

pulumi stack ls

boundless-monkey-50243

11/21/2019, 6:10 PM

I'm saying that I can't upload to a bucket with an ACL restriction.

boundless-monkey-50243

11/21/2019, 6:10 PM

Which is why we don't have them

boundless-monkey-50243

11/21/2019, 6:10 PM

And which appears related, though I'm not yet certain, to having the bucket owner account unable to find the stack.

4 Views

Open in Slack

Previous Next

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.