Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle 100 policies per principal issue #14

Open
sodre opened this issue Jul 18, 2023 · 0 comments
Open

Handle 100 policies per principal issue #14

sodre opened this issue Jul 18, 2023 · 0 comments

Comments

@sodre
Copy link
Member

sodre commented Jul 18, 2023

While running in production we ran into the following problem during initialization:

{APP} 2023-07-17 14:39:39,187 ERROR [main] c.z.n.a.c.CognitoNaiveAccessPolicyProvider Error adding principal 'grp:e8f9d592-31f9-19fb-d58d-82fe85ebbb22' to group 'identifier[e44031ed-5758-4582-9e0f-1c115da24b0a], resource[/controller], users[[ef5a965d-7bd2-ef33-21de-c444c40e462a]], groups[[e8f9d592-31f9-19fb-d58d-82fe85ebbb22, 1ce4d21a-5c20-4c1b-bc7d-f52ff5dbd792]], action[read]'
software.amazon.awssdk.services.cognitoidentityprovider.model.LimitExceededException: The limit for addUserToGroup is: 100. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: 80f36c77-ac51-439d-b8ef-00204e7ad315)

The issue is that a Cognito User/Principal can belong to at-most 100 groups. This is a hard quota that can't be modified according to AWS documentation. See Quotas on resource number and size here.

This limit seems large enough, but because a NiFi AccessPolicy is encoded as a Cognito Group we can reach that limit quickly once the number of clusters goes above ~10.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant