<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">As Steven told me on IRC, the problem
was that the user associated with my EC2 creds had the
heat_stack_user role in keystone.<br>
This role is intended to be used only for the in-instance users,
created as part of the stack, not real human users. This is
described in policy.json<br>
<br>
thanks Steven,<br>
<br>
btw: any idea about the first problem?<br>
<br>
m.<br>
<br>
<br>
<pre class="moz-signature" cols="72">Michaël Van de Borne
R&D Engineer, SOA team, CETIC
Phone: +32 (0)71 49 07 45 Mobile: +32 (0)472 69 57 16, Skype: mikemowgli
<a class="moz-txt-link-abbreviated" href="http://www.cetic.be">www.cetic.be</a>, rue des Frères Wright, 29/3, B-6041 Charleroi
</pre>
Le 03/07/2013 16:21, Michaël Van de Borne a écrit :<br>
</div>
<blockquote cite="mid:51D43372.9040606@cetic.be" type="cite">
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
Hello Steven,<br>
I'm mikemowgli from IRC. As requested, here are the logs.<br>
<br>
<br>
1. First, here's a stack trace I<b><big><big><big><big><span
style="color: rgb(0, 0, 0); font-size: 12px;
font-style: normal; font-variant: normal; font-weight:
normal; letter-spacing: normal; line-height: 21px;
text-align: left; text-indent: 0px; text-transform:
none; white-space: normal; word-spacing: 0px;
background-color: rgb(255, 255, 255); display: inline
! important; float: none;"> get in my shell
periodically (once per minute approximately), but not
in the logs: </span></big></big></big></big></b><br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a moz-do-not-send="true" href="http://pastebin.com/kPswnGNL">http://pastebin.com/kPswnGNL</a><br>
(this might not be related to cloudwatch as I got this
permanently)<br>
<br>
<br>
2. Then, here is the error I get when I perform a heat-watch
command. The logs of engine and cloudwatch are in attachment. In
order to minimize their size, I launched and killed the daemons
for this single heat-watch command.<br>
<br>
It seems that my AWS creds are accepted, but that the user does
have enough permissions. However, in keystone, the heat user is
admin of the service tenant. The config files of engine,
cloudwatch and boto (2.9.0) are also in attachment.<br>
<br>
grizzly@leonard:~$ heat-watch -d describe<br>
DEBUG:Debug level logging enabled<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="INFO:No">INFO:No</a> AlarmName passed, getting results for
ALL alarms<br>
DEBUG:Using access key found in config file.<br>
DEBUG:Using secret key found in config file.<br>
DEBUG:Got CW connection object OK<br>
DEBUG:Method: GET<br>
DEBUG:Path: /v1/<br>
DEBUG:Data: <br>
DEBUG:Headers: {}<br>
DEBUG:Host: 192.168.202.103:8003<br>
DEBUG:Params: {'Action': 'DescribeAlarms', 'Version':
'2010-08-01', 'AlarmNames.member.1': None}<br>
DEBUG:establishing HTTP connection: kwargs={'timeout': 70}<br>
DEBUG:Token: None<br>
DEBUG:using _calc_signature_2<br>
DEBUG:query string:
AWSAccessKeyId=88da7b10ddbe4f4cad198477352ef9fc&Action=DescribeAlarms&AlarmNames.member.1=None&SignatureMethod=HmacSHA256&SignatureVersion=2&Timestamp=2013-07-03T14%3A08%3A54Z&Version=2010-08-01<br>
DEBUG:string_to_sign: GET<br>
192.168.202.103:8003<br>
/v1/<br>
AWSAccessKeyId=88da7b10ddbe4f4cad198477352ef9fc&Action=DescribeAlarms&AlarmNames.member.1=None&SignatureMethod=HmacSHA256&SignatureVersion=2&Timestamp=2013-07-03T14%3A08%3A54Z&Version=2010-08-01<br>
DEBUG:len(b64)=44<br>
DEBUG:base64 encoded digest:
UaFV/v+FEOEIStrQR7BAH2ci0uGjlWP+p1TwLO8FVM0=<br>
DEBUG:query_string:
AWSAccessKeyId=88da7b10ddbe4f4cad198477352ef9fc&Action=DescribeAlarms&AlarmNames.member.1=None&SignatureMethod=HmacSHA256&SignatureVersion=2&Timestamp=2013-07-03T14%3A08%3A54Z&Version=2010-08-01
Signature: UaFV/v+FEOEIStrQR7BAH2ci0uGjlWP+p1TwLO8FVM0=<br>
DEBUG:<ErrorResponse><Error><Message>User is not
authorized to perform action:Action DescribeAlarms not allowed for
user</Message><Code>AccessDenied</Code><Type>Sender</Type></Error></ErrorResponse><br>
ERROR:403 AccessDenied<br>
ERROR:<ErrorResponse><Error><Message>User is not
authorized to perform action:Action DescribeAlarms not allowed for
user</Message><Code>AccessDenied</Code><Type>Sender</Type></Error></ErrorResponse><br>
Traceback (most recent call last):<br>
File "/usr/local/bin/heat-watch", line 281, in <module><br>
main()<br>
File "/usr/local/bin/heat-watch", line 268, in main<br>
result = cmd(opts, args)<br>
File
"/usr/local/lib/python2.7/dist-packages/heat/cfn_client/utils.py",
line 32, in wrapper<br>
ret = func(*arguments, **kwargs)<br>
File "/usr/local/bin/heat-watch", line 65, in alarm_describe<br>
result = c.describe_alarm(**parameters)<br>
File
"/usr/local/lib/python2.7/dist-packages/heat/cfn_client/boto_client_cloudwatch.py",
line 57, in describe_alarm<br>
alarm_names=[name])<br>
File
"/usr/local/lib/python2.7/dist-packages/boto/ec2/cloudwatch/__init__.py",
line 393, in describe_alarms<br>
[('MetricAlarms', MetricAlarms)])<br>
File
"/usr/local/lib/python2.7/dist-packages/boto/connection.py", line
1049, in get_list<br>
raise self.ResponseError(response.status, response.reason,
body)<br>
boto.exception.BotoServerError: BotoServerError: 403 AccessDenied<br>
<ErrorResponse><Error><Message>User is not
authorized to perform action:Action DescribeAlarms not allowed for
user</Message><Code>AccessDenied</Code><Type>Sender</Type></Error></ErrorResponse><br>
<br>
<br>
thank you for your help,<br>
<br>
michaël<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Michaël Van de Borne
R&D Engineer, SOA team, CETIC
Phone: +32 (0)71 49 07 45 Mobile: +32 (0)472 69 57 16, Skype: mikemowgli
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="http://www.cetic.be">www.cetic.be</a>, rue des Frères Wright, 29/3, B-6041 Charleroi
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Mailing list: <a class="moz-txt-link-freetext" href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a>
Post to : <a class="moz-txt-link-abbreviated" href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>
Unsubscribe : <a class="moz-txt-link-freetext" href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a>
More help : <a class="moz-txt-link-freetext" href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a>
</pre>
</blockquote>
<br>
</body>
</html>