代码之家 › 专栏 › 技术社区 › Shantaram Tupe

用户:arn:aws:sts::{account_id}:假定的角色/未被授权对资源执行:sts:AssumeRole:arn:aws:iam::{account_id}:角色/

amazon-cloudformation aws-lambda amazon-s3 amazon-web-services

Shantaram Tupe · 技术社区 · 4 年前

我正在使用cloudformation模板创建两个资源AWS Lambda函数和角色。
我使用角色arn作为环境变量。稍后在S3连接的代码中使用它。但作为例外

com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: 
User: arn:aws:sts::{account_id}:assumed-role/* is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::{account_id}:role/* 
Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: ; Proxy: null)

如何在信任关系和内联策略中添加相同的角色arn?
如何克服上述异常?

感谢其他解决方案

CF模板片段

Resources:
  LambdaFunctionExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
#             AWS:
#               - {Role ARN}
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
        - 'arn:aws:iam::aws:policy/SecretsManagerReadWrite'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
        - 'arn:aws:iam::aws:policy/CloudWatchLogsFullAccess'
        - 'arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaRole'
      Policies:
      - PolicyName: CustomLambdaPolicy
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - 'ec2:Describe*'
            - 'ec2:Get*'
            Resource: '*'

  LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: !Ref Name
      FunctionName: !Ref Name
      Handler: com.fileservice::handleRequest
      Role: !GetAtt LambdaFunctionExecutionRole.Arn
      Timeout: 900
      MemorySize: 512
      Environment:
        Variables:
          bucketName: !Ref S3BucketName
          roleARN: !GetAtt LambdaFunctionExecutionRole.Arn
      CodeUri: target/fileservice-1.0.0.jar
      Runtime: java11

AWS S3连接代码段

public AmazonS3 connectS3(String roleArn, String region) {
    STSAssumeRoleSessionCredentialsProvider stsAssumeRoleSessionCredentialsProvider = new STSAssumeRoleSessionCredentialsProvider.Builder(
            roleArn, "MySession").withStsClient(AWSSecurityTokenServiceClientBuilder.standard().build())
                    .withRoleSessionDurationSeconds(900).build();

    BasicSessionCredentials basicSessionCredentials = new BasicSessionCredentials(
            stsAssumeRoleSessionCredentialsProvider.getCredentials().getAWSAccessKeyId(),
            stsAssumeRoleSessionCredentialsProvider.getCredentials().getAWSSecretKey(),
            stsAssumeRoleSessionCredentialsProvider.getCredentials().getSessionToken());

    System.out.println("serviceEndpoint:- "+ String.format("https://s3.%s.amazonaws.com", region) );
    AmazonS3 s3Client = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(basicSessionCredentials))
                            .withEndpointConfiguration( new EndpointConfiguration( String.format("https://s3.%s.amazonaws.com", region), region) )
                            .build();
    return s3Client;
}

0 回复 | 直到 4 年前

Kaustubh Khavnekar 4 年前

LambdaFunction:
  Type: AWS::Serverless::Function
  Properties:
    Role: !GetAtt LambdaFunctionExecutionRole.Arn

如果您正在使用AWS::Serverless::Function的角色属性,则不需要在Lambda代码中再次承担该角色。任何AWS SDK或CLI都将自动检索与该角色相关联的凭据。

参考: https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html (来自文档:创建函数时提供此角色,调用函数时Lambda承担此角色。)

忽略这样一个事实,即您不应该有理由允许角色自行承担,使用CloudFormation,不可能在角色定义本身中引用角色的ARN。正在尝试使用!GetAtt LambdaFunctionExecutionRole。LambdaFunctionExecutionRole的信任策略中的Arn会产生循环依赖性错误。

编辑OP现在已包含在问题中的代码更改:

而不是:

public AmazonS3 connectS3(String roleArn, String region) {
    STSAssumeRoleSessionCredentialsProvider stsAssumeRoleSessionCredentialsProvider = new STSAssumeRoleSessionCredentialsProvider.Builder(
            roleArn, "MySession").withStsClient(AWSSecurityTokenServiceClientBuilder.standard().build())
                    .withRoleSessionDurationSeconds(900).build();

    BasicSessionCredentials basicSessionCredentials = new BasicSessionCredentials(
            stsAssumeRoleSessionCredentialsProvider.getCredentials().getAWSAccessKeyId(),
            stsAssumeRoleSessionCredentialsProvider.getCredentials().getAWSSecretKey(),
            stsAssumeRoleSessionCredentialsProvider.getCredentials().getSessionToken());

    System.out.println("serviceEndpoint:- "+ String.format("https://s3.%s.amazonaws.com", region) );
    AmazonS3 s3Client = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(basicSessionCredentials))
                            .withEndpointConfiguration( new EndpointConfiguration( String.format("https://s3.%s.amazonaws.com", region), region) )
                            .build();
    return s3Client;
}

为什么不这么做呢?

public AmazonS3 connectS3(String region) {
   
    AmazonS3 s3Client = AmazonS3ClientBuilder.standard().withRegion(region).build();
    return s3Client;
}

如果您的代码在AWS Lambda函数中运行,则不需要执行“假定角色”操作来获取凭据,只需直接使用分配给Lambda函数的角色即可访问S3。尝试承担一个角色的唯一原因是,它是一个完全独立的角色,具有分配给AWS Lambda功能的角色所没有的所需权限。

用户:arn:aws:sts::{account_id}:假定的角色/*未被授权对资源执行:sts:AssumeRole:arn:aws:iam::{account_id}:角色/*

用户:arn:aws:sts::{account_id}:假定的角色/未被授权对资源执行:sts:AssumeRole:arn:aws:iam::{account_id}:角色/