AWS Database Migration Service getting AccessDeniedFault

[CptMo]

Hello everyone, I hope this is the right place to hunt down a problem that I'm experiencing with CDK currently. If not please point me to the correct channel.

Situation

I build a CDK app for creating resources in the Database Migration Service with python. I'm aware of #7632 ! So I added the workaround into my code. It worked like a charm until yesterday.

Problem

Right now I get the following error:

09:52:12 | CREATE_FAILED        | AWS::DMS::ReplicationSubnetGroup            | dmsreplicationsubnetgroup
The IAM Role arn:aws:iam::748279635563:role/dms-vpc-role is not configured properly. (Service: AWSDatabaseMigrationService; Status Code: 400; Error Code: AccessDeniedFault; Request ID: 0d734bca-9309-4d4f-8b0b-fb4217a4c558; Proxy: null)

Questions that I have here: How should the role be extended in order to allow the creation of the AWS::DMS::ReplicationSubnetGroup ? I tried already adding all DMS-related rights to the role including dms:*

The Code for creating the IAM Roles

# CREATE IAM ROLE FOR REPLICATION INSTANCE
    replication_instance_role = iam.Role(
        self,
        "dms-vpc-role,
        role_name="dms-vpc-role",
        assumed_by=iam.ServicePrincipal(
            "dms.amazonaws.com",
        ),
        description="Role to give DMS Service access to ec2 to create replication instance",
    )
    replication_instance_role.add_managed_policy(
        iam.ManagedPolicy.from_aws_managed_policy_name(
            "service-role/AmazonDMSVPCManagementRole"
        )
    )
    cloudwatch_logs_role = iam.Role(
        self,
        "dms-cloudwatch-logs-role",
        role_name="dms-cloudwatch-logs-role",
        assumed_by=iam.ServicePrincipal(
            "dms.amazonaws.com",
        ),
        description="Role to give DMS Service access cloudwatch log groups",
    )
    cloudwatch_logs_role.add_managed_policy(
        iam.ManagedPolicy.from_aws_managed_policy_name(
            "service-role/AmazonDMSCloudWatchLogsRole"
        )
    )

Roles are according to the documentation:

https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html#CHAP_Security.IAMPermissions

Manual Steps Taken

So when I create the IAM roles via AWS CLI and then create the subnet group via AWS console it works. Also when I delete the IAM Role and create the subnet group via console itself, it works too and the role is created automatically.
Has anyone experienced the same problem? Or maybe point me in the right direction?

Thanks in advance for any help.

[mssanjay]

Hi, were you able to resolve this issue? I am too facing the same error. Thanks in Advance!