AWS IAM / QuickSight-用户无权执行：quicksight：资源上的GetDashboardEmbedUrl

Question

我正在尝试在ASP.NET MVC项目中使用嵌入的QuickSight仪表板URL函数。 为了进行测试，我只是尝试将嵌入的URL输出到字符串。 这是我的代码的主要部分：

    var awsCredentials = new BasicAWSCredentials("redacted", "redacted");

    AmazonSecurityTokenServiceClient stsClient = new AmazonSecurityTokenServiceClient(awsCredentials);
    var tokenServiceRequest = stsClient.GetSessionToken();

    var client = new AmazonQuickSightClient(
        tokenServiceRequest.Credentials.AccessKeyId,
        tokenServiceRequest.Credentials.SecretAccessKey,
        tokenServiceRequest.Credentials.SessionToken,
        Amazon.RegionEndpoint.APSoutheast2);
    try
    {
        string machineTypeEmbedUrl =
            client.GetDashboardEmbedUrlAsync(new GetDashboardEmbedUrlRequest
            {
                AwsAccountId = "redacted",
                DashboardId = "redacted",
                IdentityType = IdentityType.IAM,
                ResetDisabled = true,
                SessionLifetimeInMinutes = 100,
                UndoRedoDisabled = false
            }).Result.EmbedUrl;
    }
    catch (Exception ex)
    {
        return new HttpStatusCodeResult(HttpStatusCode.BadRequest,ex.Message);
    }

为了支持所需的权限，我已经设置了具有STS假定角色的IAM用户，如下所示：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1551593192075",
            "Action": [
                "sts:AssumeRole"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::redacted:role/assume-quicksight-role"
        }
    ]
}

我已经使用以下权限设置了上面指定的角色，并设置了其信任策略，以便上述IAM用户可以承担该角色。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "quicksight:RegisterUser",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "quicksight:GetDashboardEmbedUrl",
            "Resource": "arn:aws:quicksight:ap-southeast-2:redacted:dashboard/redacted",
            "Effect": "Allow"
        }
    ]
}

据我所知这应该工作。 调试显示我确实获得了会话令牌，该令牌已传递到embedUrl请求，但是出现以下错误：

InnerException = {“用户：arn：aws：iam :::: user / api-dev-quicksight-用户无权执行：资源上的quicksight：GetDashboardEmbedUrl：arn：aws：quicksight：ap-southeast-2 :: dashboard / “}

我不确定为什么会这样？ 我有一个可以担当正确角色的用户，并且该角色对所涉及的仪表板具有正确的权限。 我在这里想念什么？

Answer 1

尝试像这样更改您的角色（注意:: dashboard前的::双冒号）：

...
"Action": "quicksight:GetDashboardEmbedUrl", 
"Resource": "arn:aws:quicksight:ap-southeast-2::dashboard/*", 
"Effect": "Allow"
...

这应该允许用户访问仪表板下的所有子资源。

要遵循AWS建议的最低特权原则 ，您应该列出所有资源：

...
"Resource": [
    "arn:aws:quicksight:ap-southeast-2::dashboard/", 
    "arn:aws:quicksight:ap-southeast-2::dashboard/redacted"]
...