带有命名配置文件的s3中的AWS Redshift复制命令

Question

I can use AWS cli like this:

aws --profile prfName s3 ls s3://mybucket

but when I use redshift like this:

copy eventStream.Events_Adobe
from 's3://cassemrtest/eventStream.csv'
region 'us-east-1'
credentials 'aws_access_key_id=xxxxxx;aws_secret_access_key=Rxxxxx[;token=xxxxxx]';

I get this error:

[Amazon](500310) Invalid operation: S3ServiceException:The request signature we calculated does not match the signature you provided. Check your key and signing method.,Status 403,Error SignatureDoesNotMatch,Rid xxxxxxxx,ExtRid xxxxxx
Details: 
 -----------------------------------------------
  error:  S3ServiceException:The request signature we calculated does not match the signature you provided. Check your key and signing method.,Status 403,Error SignatureDoesNotMatch,Rid xxxxx,ExtRid xxxxxx
  code:      8001
  context:   Listing bucket=cassemrtest prefix=eventStream.csv
  query:     1690
  location:  s3_utility.cpp:529
  process:   padbmaster [pid=25203]
  -----------------------------------------------;

Execution time: 0.3s
1 statement failed.

I think this is because I'm missing the profile name...how do I put in the profile name like I do when I use AWS CLI?

Answer 1

The error indicates a bad set of credentials.

The AWS Command-Line Interface (CLI) is used on a computer (either your own, or on Amazon EC2) to communicate with the AWS APIs. You can use a local credentials file to authenticate to AWS. In your case, the credentials file contains multiple credentials stored as profiles, so the --profile parameter tells it which profile to use.

However, this credentials file is not used when sending commands to Amazon Redshift. Communications to Redshift is done via SQL rather than the AWS CLI.

When using the Redshift COPY command, provide the Access Key and Secret Key directly, rather than referring to a credentials file. It should look something like:

copy eventStream.Events_Adobe
from 's3://cassemrtest/eventStream.csv'
region 'us-east-1'
credentials 'aws_access_key_id=AKIAJ24FFOOBAR7VPMCT;aws_secret_access_key=2IpmAExampleKeyYsiXrqwyfza';

You most likely won't require the Token , since it is only used with temporary credentials.