AWS timestream-write gets "An error occurred (AccessDeniedException) when calling the DescribeEndpoints operation: This operation is not allowed."

Question

I am experimenting the AWS SDK for python to access Timestream. I tried their in house example code from the repository and I wrote my own code to create a database:

import boto3
from botocore.config import Config

client = boto3.client('timestream-write')

response = client.create_database(DatabaseName='test')

Both sample code and my own code got the following error:

AccessDeniedException: An error occurred (AccessDeniedException) when calling the DescribeEndpoints operation: This operation is not allowed.

I googled a bit, but I could not find any information about it. Thanks!

Answer 1

Timestream is currently only available in a handful of regions. Make sure the boto3 region configuration set the correct region to those eligible ones.

Answer 2

The credentials that you are using to interact with Timestream should use an IAM role that has has either an AWS managed policy or a custom policy that allow you to call timestream:DescribeEndpoints. See this page for an example: https://docs.aws.amazon.com/timestream/latest/developerguide/security_iam_id-based-policy-examples.html

Assuming you configured your environment to use the AWS CLI and ran aws configure, the IAM User that is tied to those credentials should be granted timestream:DescribeEndpoints. https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html

You may have gotten this permissions error because you are missing TableName, which is a required parameter. https://docs.aws.amazon.com/timestream/latest/developerguide/API_CreateTable.html

Answer 3

in your iam role add this permission policy

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "timestream:DescribeEndpoints"
        ],
        "Resource": "*"
    }
] }

DescribeEndpoints is called bt sdk in case you defined endpoints interface like this in your vpc query-cell2.timestream..amazonaws.com.