Rain forecast uses assumed role to get the registry schema #203
Labels
enhancement
New feature or request
forecast
Related to the forecast command that predicts deployment failures
The forecast command uses the role specified by
--role-arn
for all SDK calls, including the registry lookup, which causes it to fail since the stack deployment role doesn't need this permission. We need to either cache all registry schemas locally, or use different credentials for different SDK calls. Only the IAM policy simulator should use the specified role arn. The registry lookup should assume the user's credentials.The text was updated successfully, but these errors were encountered: