S3存储桶中的访问被拒绝

Question

请帮助我面对奇怪的问题，我正在尝试访问S3存储桶图像，我能够列出存储桶项目，但是当尝试使用指向的url在Web应用程序中呈现图像时，出现“ 访问被拒绝”错误。 我正在使用cognito（联合身份）。

已经设置了Trust RelationShip

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "us-east-1:"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "unauthenticated"
        }
      }
    }
  ]
}

这是我的完整代码

protected IAmazonEC2 ec2;
        protected IAmazonS3 s3;
        protected IAmazonSimpleDB sdb;
        protected void Page_Load(object sender, EventArgs e) {


            CognitoAWSCredentials credentials = new CognitoAWSCredentials(
    "us-east-1:ox0d70gm-1922z-4772-b2132-9748c6548bdb", // Identity pool ID
    RegionEndpoint.USEast1);


            Console.WriteLine("Identity ID: " + credentials.GetCredentials().Token);
            Console.WriteLine("Identity ID: " + credentials.GetCredentials().UseToken);
            Console.WriteLine("Access Key Id" + credentials.GetCredentials().AccessKey);
            Console.WriteLine("Secret Key:" + credentials.GetCredentials().SecretKey);


            IAmazonS3 s3Client = new AmazonS3Client(credentials);

            try {

                ListBucketsResponse response = s3Client.ListBuckets();

                List<S3Bucket> lS3Bucket = response.Buckets;

                foreach (S3Bucket s3 in lS3Bucket) {
                    Console.WriteLine(s3.BucketName);

                    ListObjectsV2Request request = new ListObjectsV2Request {
                        BucketName = s3.BucketName
                    };

                    ListObjectsV2Response responseV2;

                    responseV2 = s3Client.ListObjectsV2(request);

                    foreach (S3Object entry in responseV2.S3Objects) {

                        if(s3.BucketName== "saveen-2017-june-15") {
                            Response.Write("<img src='https://s3.amazonaws.com/"+ entry.BucketName + "/"+ entry.Key + "' height=100 width=100/>"); // access denied error
                        }
                    }
                }

                int numBuckets = 0;
                if (response.Buckets != null &&
                    response.Buckets.Count > 0) {
                    numBuckets = response.Buckets.Count;
                }
                Console.WriteLine("You have " + numBuckets + " Amazon S3 bucket(s).");
            } catch (AmazonS3Exception ex) {
                if (ex.ErrorCode != null && (ex.ErrorCode.Equals("InvalidAccessKeyId") ||
                    ex.ErrorCode.Equals("InvalidSecurity"))) {
                    Console.WriteLine("Please check the provided AWS Credentials.");
                    Console.WriteLine("If you haven't signed up for Amazon S3, please visit http://aws.amazon.com/s3");
                } else {
                    Console.WriteLine("Caught Exception: " + ex.Message);
                    Console.WriteLine("Response Status Code: " + ex.StatusCode);
                    Console.WriteLine("Error Code: " + ex.ErrorCode);
                    Console.WriteLine("Request ID: " + ex.RequestId);
                }
            }

更新部分

我进一步研究发现，我需要在以下位置实现开发者身份验证身份验证流程（增强的验证流程）

步骤如下

通过开发人员提供商登录（Amazon Cognito以外的代码）
验证用户的登录名（Amazon Cognito之外的代码）
GetOpenIdTokenForDeveloperIdentity
GetCredentialsForIdentity

下面是上面要实现的完整代码

class Program {
    public static void Main(string[] args) {

        //GetOpenIdTokenForDeveloperIdentity
        CognitoAWSCredentials credentials = new CognitoAWSCredentials(
                "us-east-1:#####-####-####-####-########", RegionEndpoint.USEast1);

        //GetCredentialsForIdentity
        GetCredentialsForIdentityResponse tokenResp = identityClient.GetCredentialsForIdentity(credentials.GetIdentityId());

        string date = GetRoute53Date();

        Console.WriteLine(GetAWSR53_SHA1AuthorizationValue(tokenResp.Credentials.GetCredentials().AccessKey, tokenResp.Credentials.GetCredentials().SecretKey, date));
        // Now here I have Access key and Signature

        Console.Read();
    }



    public static string GetAWSR53_SHA1AuthorizationValue(string AWSAccessKeyId,
        string AWSSecretAccessKey, string AmzDate) {
        System.Security.Cryptography.HMACSHA1 MySigner =
           new System.Security.Cryptography.HMACSHA1(
           System.Text.Encoding.UTF8.GetBytes(AWSSecretAccessKey));

        string SignatureValue = Convert.ToBase64String(
          MySigner.ComputeHash(System.Text.Encoding.UTF8.GetBytes(AmzDate)));

        string AuthorizationValue = "AWS3-HTTPS AWSAccessKeyId=" +
           System.Uri.EscapeDataString(AWSAccessKeyId) +
           ",Algorithm=HmacSHA1,Signature=" + SignatureValue;

        return AuthorizationValue;
    }

    public static string GetRoute53Date() {
        string url = "https://route53.amazonaws.com/date";
        HttpWebRequest request = WebRequest.Create(url) as HttpWebRequest;
        request.Method = "GET";
        HttpWebResponse response;
        response = request.GetResponse() as HttpWebResponse;
        return response.Headers["Date"];
    }

}

现在，我正在访问S3存储桶映像资源并想要显示。

我正在使用下面的代码

GET /####-###-###-15/myfile.png HTTP/1.1
Host: s3.amazonaws.com
Authorization: AWS ASIAJ4DZFDVDEB3GSNDA:ulAQKnJkiLAWFg8cB+F+5hje0mE=
x-amz-date: Thu, 26 Apr 2018 07:14:18 GMT
Cache-Control: no-cache

这给了我下面给出的错误

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>InvalidAccessKeyId</Code>
    <Message>The AWS Access Key Id you provided does not exist in our records.</Message>
    <AWSAccessKeyId>ASIAJ4DZFDVDEB3GSNDA</AWSAccessKeyId>
    <RequestId>C593C6DE5E004836</RequestId>
    <HostId>fS+WnzQo0UtqlUaLyoMfIxbKElRs56xYPcL8bNn62VQ41HLG26Mr2Aq+2UL6IsZvO1xFxp6lZdc=</HostId>
</Error>