Resolving IAM Permissions Error for iam:PassRole in Dremio Cloud

Summary

Users may encounter a permissions error when attempting to spin up an engine in their Dremio Cloud environment. This issue typically arises due to insufficient permissions for the user associated with the AWS assumed role, specifically related to the iam:PassRole action. This article provides step-by-step instructions for resolving this error.

Main Content

If you encounter a permissions error while scaling or creating an engine in Dremio Cloud due to the iam:PassRole action, follow these steps to resolve the issue:

Steps to Resolve the IAM Permissions Error:

1. Identify the Assumed Role:
   • Note the ARN (Amazon Resource Name) of the assumed role that is facing the permission error. An example is arn:aws:sts::[AccountID]:assumed-role/[RoleName]/[SessionName].
2. Access IAM Policies:
   • Navigate to the AWS IAM Console.
   • Locate the role associated with the erroneous operation (e.g., dremio-cloud-test-DremioIAMCloudComputeRole-HEKSLH2HDs8).
3. Modify the IAM Policy:
   • Within this role, find and edit the IAM policy (typically named dremio-cloud-compute-policy-create) to include the necessary permissions.

   • Ensure the policy has the following permissions set:

     {
       "Action": ["iam:PassRole", "sts:AssumeRole"],
       "Resource": "arn:aws:iam::[AccountID]:role/[TargetRoleName]",
       "Effect": "Allow"
     }
     

   • Replace [AccountID] and [TargetRoleName] with your actual AWS account ID and the target role name that your operation is trying to assume.
4. Save and Apply Changes:
   • Save the updated policy and ensure it is applied to the role.
5. Test the Configuration:
   • Attempt to create or scale your engine again within the Dremio Cloud project to verify that the issue has been resolved.

Troubleshooting Tip:

• If the issue persists after updating the role policy, double-check that there are no conflicting policies attached to the role that might be denying the iam:PassRole action.

Additional Information:

• Ensure that your Dremio project setup aligns with AWS best practices for IAM role management. If you originally set up the project using a CloudFormation Template (CFT), review your template configuration to ensure role permissions are correctly specified.

By following the above steps, you should be able to address the iam:PassRole permissions error in your Dremio Cloud environment effectively. For ongoing issues, consider consulting with a cloud administrator or using AWS support for additional assistance.