SAP CAL Template - AWS Organisation SCP issue "SimulatePrincipalPolicy"

[RingoSommer]

Hello Community

We try to deploy SAP System into our own AWS Account, but facing severals unknow issues.

Whole configuration regards to user management "user" - standard policy and customer inline policy - are implemented as described from AWS https://caldocs.hana.ondemand.com/caldocs/help/AWS_FAQs.pdf point of view. User has a valid AK/SK and is just configured for AWS CLI / API needs.

During few more validaitons, we getting the following issue from SimulatePrincipalPolicy point of view.

After a deep dive and execution command via console there is a result for each KMS part "implicitDeny" and it feels like workflow is crashing and there is no possiblity to deploy SAP System from SAP CAL point of view.

Any ideas how to fix this issue in general, each new deployment is mentioned issue with AWS KMS and failed always?

Who is taking care of the overall deployment workflow/implementation SAP or AWS?

If something missing for validation or further deep dive please let me know.

Thanks in advance and your support.

Regards

Ringo

[tsvetinka_gaydazhieva]

Hi RingoSommer ,

Please try again to create a new appliance.

In case the problem is still reproducible, please check your global account policies, if there are any that prohibit the activation of policies required by us.

Best regards,

Tsvetinka 

[tsvetinka_gaydazhieva]

According to the firs post, you have a policy that prohibits kms:Decrypt.

[RingoSommer]

The used AWS Account is part of more AWS Accounts, handle by AWS Organisation including Service Control Policy configuration. When I'm checking AWS CloudTrail / CloudWatch logs, I'm not able to catch an useful log entry because it is not crossing the AWS Account to do something there. From my understandig it is already failing during the checks with SimulatePrincipalPolicy. The user is fully configured as described. Now we just expect that the validation is failing and stopping the whole workflow to proceed due to mismatch of "deny". I'm not sure how to configure the AWS Account to allow each and everything, each company should protect as much as possible. Not sure what the workflow to deploy an appliance is doing the background maybe we need to have a look there, but still wondering why it is not working. Thanks for your support.

[tsvetinka_gaydazhieva]

Hi RingoSommer,

There is not workaround in your case.

You must meet all listed here requirements to be able to create an appliance. According to provided screenshots you have not done it yet. 

Best regards,

Tsvetinka

[RingoSommer]

Hello Tsvetinka

[RingoSommer]

the following inline policy is configured but it is not working as expected. Issue highlighted everytime after starting the deployment of appliance. { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:*" ], "Resource": [ "*" ] } ] }