[英]AWS AssumeRole - User is not authorized to perform: sts:AssumeRole on resource
我试图在我的 PHP 程序中使用 AWS sts 调用 AssumeRole 函数,因为我想创建临时凭证以允许用户为 AWS 存储桶创建对象。
下面是我调用 PHP 的函数:
$sts = StsClient::factory(array(
'key' => 'XXXXXXXXXXXXXX',
'secret' => 'XXXXXXXXXXXXXXXX',
'token.ttd' => $timetodie
));
$bucket = "mybucket";
$result1 = $sts->assumeRole(array(
'RoleArn' => 'arn:aws:iam::123456789012:role/createPic',
'RoleSessionName' => 'mytest',
'Policy' => json_encode(array(
'Statement' => array(
array(
'Sid' => 'Deny attributes',
'Action' => array(
's3:deleteObject',
's3:deleteBucket'
),
'Effect' => 'Deny',
'Resource' => array(
"arn:aws:s3:::{$bucket}",
"arn:aws:s3:::{$bucket}/AWSLogs/*"
),
'Principal' => array(
'AWS' => "*"
)
)
)
)
),
'DurationSeconds' => 3600,
// 'ExternalId' => 'string',
));
$credentials = $result1->get('Credentials');
但是,我不断收到以下错误:
User arn:aws:iam::123456789012:user/TVMUser is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/createPic
以下是我的 AWS 控制台上用户 TVMUser 的权限策略:
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":"ec2:RunInstances",
"Resource":"*"
},
{
"Effect":"Allow",
"Action":"iam:PassRole",
"Resource":"arn:aws:iam::791758789361:user/TVMUser"
},
{
"Effect":"Allow",
"Action":"sts:AssumeRole",
"Resource":"arn:aws:iam::791758789361:role/createPic"
}
]
}
以下是我对 createPic 角色的角色政策:
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":"ec2:RunInstances",
"Resource":"*"
},
{
"Effect":"Allow",
"Action":"iam:PassRole",
"Resource":"arn:aws:iam::791758789361:user/TVMUser"
},
{
"Effect":"Allow",
"Action":"sts:AssumeRole",
"Resource":"arn:aws:iam::791758789361:role/createPic"
}
]
}
现在有没有人知道我在 AWS 策略声明和 AWS 上的设置中遗漏了什么,所以我没有收到以下错误?
User arn:aws:iam::123456789012:user/TVMUser is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/createPic
我错过了什么吗?
您还需要编辑角色的信任关系,以允许该帐户(即使是相同的)承担该角色。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
},
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/some-role"
},
"Action": "sts:AssumeRole"
}
]
}
在此示例中,我必须使用正确的帐号添加“AWS”委托人,ec2.amazonaws.com 服务已经存在。
在我完成之后,我能够毫无问题地担任这个角色。 我花了几个小时才弄清楚这一点,希望对某人有所帮助。
也许您应该分配您的 sts 区域和端点:
$sts = StsClient::factory(array(
//...
'region' => 'us-west-2',
'endpoint' => 'https://sts.us-west-2.amazonaws.com',
));
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.