映射具有角色的IAM用戶后，權限被拒絕

Question

有人可以幫助我解決拒絕權限的問題。 讓我知道是否有任何缺失或錯誤。

使用以下策略為服務Elastic Container Service Task創建了新角色custom-iams-orchestration-role

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "*"
        }
    ]
}

並通過添加以下角色角色來信任具有相同帳戶的用戶

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com",
        "AWS": "arn:aws:iam::accountid:user/iams-dev-user"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

並且為用戶iams-dev-user添加了以下策略以承擔角色

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::accountid:role/custom-iams-orchestration-role"
        }
    ]
}

但是在執行aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile iams-dev-user --region=us-east-1時遇到問題， aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile iams-dev-user --region=us-east-1用戶iams-user-dev鍵從我的筆記本電腦中aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile iams-dev-user --region=us-east-1

User:arn:aws:iam::accountid:user/iams-dev-user is not authorized to perform

Answer 1

您實際上需要承擔不會自動發生的角色 。 這將為您提供訪問密鑰，機密和會話令牌，以便隨后與其他命令一起使用。 如果您不想承擔任何角色，則需要直接為用戶分配策略。

例

使用AWS CLI承擔相關角色

aws sts assume-role --role-arn arn:aws:iam::accountid:role/custom-iams-orchestration-role --role-session-name orchestration-access-example --profile iams-dev-users

這將為您提供包含新的訪問密鑰 ， 秘密和會話令牌的輸出 ：

"Credentials": {
    "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
    "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=",
    "Expiration": "2016-03-15T00:05:07Z",
    "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"
}

在憑證文件中使用以下值：

[assumed-role]
aws_access_key_id = ASIAJEXAMPLEXEG2JICEA
aws_secret_access_key = 9drTJvcXLB89EXAMPLELB8923FB892xMFI
aws_session_token = AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=

使用此臨時配置文件執行所需的命令，如下所示：

aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile assumed-role --region=us-east-1