We Keep Coding

Service account is not authorized to manage project

I recently joined a team, and am adding Android Management Api to the already existing project. I added the management API, created service accounts with permissions, and am writing the .NET project to test it out.
I made a service account with Android Management User and Owner permissions. However, when I try to use the .NET library to make an enterprise, I get
The service androidmanagement has thrown an exception. HttpStatusCode is Forbidden. Caller is not authorized to manage project.
If it helps:
The API key I'm using is allowed to call any API, and the application name is a temporary one that does NOT match the project name. As for the service account with private key, I am using a FileStream to read a .json file downloaded when the service account was created.
This is my code, based on the sample app https://developers.google.com/android/management/sample-app
The error gets thrown on the createRequst.Execute()
string CreateEnterprise()
{
SignupUrlsResource.CreateRequest signupUrlRequest = managementService.SignupUrls.Create();
signupUrlRequest.ProjectId = cloud_project_id;
signupUrlRequest.CallbackUrl = "https://www.yahoo.com";
var signupUrl = signupUrlRequest.Execute();
string enterpriseToken = signupUrl.Url;
Console.WriteLine("Signup: " + enterpriseToken);
EnterprisesResource.CreateRequest createRequest = managementService.Enterprises.Create(new Enterprise());
createRequest.ProjectId = "Test Project";
createRequest.SignupUrlName = signupUrl.Name;
createRequest.EnterpriseToken = enterpriseToken;
var enterprise = createRequest.Execute();
return enterprise.Name;
}

Turns out the createRequest.ProjectId must match the project name that has the Android Management API, aka the project I'm working with.

Cross Account Access to DynamoDb tables C#

I have been dealing with this issue for which I am not able to find solution online anywhere.
I have a code which connects to AWS DynmoDb and performs read/write operations on one or more tables. This worked fine as long as my code and the DynamoDb table are in the same AWS account. Also the code uses the IAM Role attached to the Web Server. The role as all the necessary permissions assigned to it.
private AmazonDynamoDBClient GetDbClient(int ConnectionTimeOut, int ReadWriteTimeOut, int MaxRetry)
{
AmazonDynamoDBConfig clientConfig = new AmazonDynamoDBConfig
{
Timeout = TimeSpan.FromMilliseconds(ConnectionTimeOut),
ReadWriteTimeout = TimeSpan.FromMilliseconds(ReadWriteTimeOut),
MaxErrorRetry = MaxRetry
};
return new AmazonDynamoDBClient(clientConfig);
}
Recently I need to move my code to different AWS account and things started going crazy.
Following steps I have already taken.
VPC Peering done between the VPC in the old AWS account and the new AWS account.
Cross account permissions on the DynamobDb tables are given to the role which is used by the Web server on the new AWS Account.
With this change, I do not see any more permission errors but the code tries to look for the table on the new AWS account.
It is clear in the code that AWS AccountId is not used anywhere while creating AWS DynamoDb client. So I assume that I should be able to tell the code where to look for DynamoDb table. But the C# SDK of DynamoDb does not have any provision where I can provide AWS AccountId while creating DynamoDb client.
So my issue here is related to C# code to connect to DynamoDb service and not the IAM roles and permissions on AWS (for this I am able to fine plenty of solution).
Found this question aws cross account dynamodb access with IAM role with similar issue but it does not suggest the fix to do in the code.

One way to proceed is to use Security Token Service. First you need to assume a role and get temporary credentials:
Credentials GetCredentials(String roleArn)
{
using (var stsClient = new AmazonSecurityTokenServiceClient())
{
try
{
var response = stsClient.AssumeRole(new AssumeRoleRequest(roleARN));
if (response.HttpStatusCode == System.Net.HttpStatusCode.OK) return response.Credentials;
}
catch (AmazonSecurityTokenServiceException ex)
{
return null;
}
}
}
You can then use the credentials to initiate your DynamoDB client.
See another example here.

The AWS SDK and CLI (whether it's running locally or on (say) an EC2 instance) looks in the following locations for credentials:
Command line options
Environment variables
CLI credentials file
CLI configuration file
Container credentials
Instance profile credentials
If you have a credentials file configured, then, assuming we're running under the default profile, this will indirectly define the account under which it is running via the access key provided.
You can also define AWS-specific environment variables, such as AWS_ACCESS_KEY_ID which take precedence over the credentials file.
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html

Retrieving secrets from AWS with C# without storing access credentials in code base

I want to store sensitive data in my .Net Core C# app in AWS secret manager. I have created my secret in the portal but when I try to access it with the following code:
var config = new AmazonSecretsManagerConfig
{
ProxyHost = "MyProxyHost",
ProxyPort = 8080,
ProxyCredentials = CredentialCache.DefaultCredentials,
Timeout = TimeSpan.FromMinutes(5),
MaxErrorRetry = 1,
RegionEndpoint = RegionEndpoint.MyRegion,
};
var client = new AmazonSecretsManagerClient(config);
I then get this message when trying to use the secret manager client:
Unable to get IAM security credentials from EC2 Instance Metadata
Service
This is unsurprising as I haven't given any information that indicates I should be able to access secrets manager. I can gain access with the following code:
var config = new AmazonSecretsManagerConfig
{
ProxyHost = "MyProxyHost",
ProxyPort = 8080,
ProxyCredentials = CredentialCache.DefaultCredentials,
Timeout = TimeSpan.FromMinutes(5),
MaxErrorRetry = 1,
RegionEndpoint = RegionEndpoint.MyRegion,
};
var client = new AmazonSecretsManagerClient("MyAWSAccessKeyId", "MyAWSSecretAccessKey", config);
This though means that I have to store my sensitive data in my application, which is what I wanted to avoid in the first place. In Azure, using KeyVault this could be avoided using the right NuGet package and managed identities. I am wondering if there is a similar solution for AWS for both applications hosted in AWS and local development?

You can use IAM roles
Create an IAM role which has necessary permissions and attach the role to your EC2 instance. AmazonSecretsManagerClient will assume this IAM role when code is executed from an EC2 instance.
For local development : You can configure aws credentials with IAM role so that this role will be assumed when your code is executed from local machine.

Azure App Configuration to retrieve configuration values from c# Azure function via Managed Identity is not working

I have created Azure App configuration and sets Key and value pairs. I have also created a HTTP Azure function via VS 2019 and write below code.
using Microsoft.Extensions.Configuration;
using Azure.Identity;
var config = new ConfigurationBuilder().AddAzureAppConfiguration(options =>
{
options.Connect(new Uri("https://xxx-xxx-azf-global-parameters.azconfig.io"),
new ManagedIdentityCredential());
}).Build();
string str = config["AzfApp:Cloud"].ToString();
log.LogInformation("AzfApp:Cloud:" + config["AzfApp:Cloud"].ToString());
Enable System assigned Identity of Azure Function. The identity I am using via ManagedIdentityCredential is assigned to both the Azure App Configuration Data Reader and Azure App Configuration Data Owner roles. But above my code is not working Azure portal. I have capture the error via log information.
Error message :Retry failed after 3 tries. (No such host is known.) (No such host is known.) (No such host is known.)Source=Azure.CoreStackTrace:at Azure.Core.Pipeline.RetryPolicy.
Please help on this how do I resolve the issue.

I test in my site with your code and it works very well.
Go to azure app configuration and double check that you have assign Azure App Configuration Data Reader to the function's Identity.
And the output screenshot is as below:

How to delete Azure Batch Pool and Jobs using Managed Identity?

Using C# I can delete Azure Batch Pools and Jobs using Client ID and Client Secret - but currently we want to delete them by using Azure Functions using Managed Identity.
Here is my current code:
internal async Task<string> GetAuthenticationTokenAsync()
{
var authContext = new AuthenticationContext(AuthorityUri);
var authResult = await authContext.AcquireTokenAsync(BatchResourceUri, new ClientCredential(BatchCredentials["ClientId"], BatchCredentials["ClientKey"])).ConfigureAwait(false);
return authResult.AccessToken;
}
Task<string> TokenProvider() => GetAuthenticationTokenAsync();
using (var Batch = BatchClient.Open(new BatchTokenCredentials(BatchCredentials["BatchAccountURL"], TokenProvider)))
{
var CloudPools = Batch.PoolOperations.ListPools();
var JobList = Batch.JobOperations.ListJobs();
foreach (var pool in CloudPools)
{
pool.DeleteAsync();
}
foreach (var job in JobList)
{
job.DeleteAsync();
}
}
I see that in msdn social that there is no support for MSI currently in Azure Batch, so is there any alternative to just delete the Azure Batch Pools and Jobs ?
note: if it is not possible in C#, I am comfortable using Rest API or PowerShell also for deleting the pools and jobs of the batch account

2021-02-17 Updated Answer:
Managed Identity on Batch pools is now in public preview in select regions. Please see this doc.
Original Answer:
Managed Identity is not supported on Azure Batch compute nodes, however, you can use Managed Identities on other Azure resources that support it to authenticate with the Azure Batch resource provider. Please see this doc.