ECS 任务拒绝访问 S3 ENV 文件答案

【问题标题】：ECS Task Denied access to S3 ENV fileECS 任务拒绝访问 S3 ENV 文件
【发布时间】：2023-01-10 12:07:40
【问题描述】：

我发现了一些像this one这样的帖子，我认为它们可以为我解决我的问题，但我仍然得到无法下载 env 文件错误。

我的工作流程：

运行 FARGATE 任务定义的 ECS 集群
任务定义：网络模式AWSVPC在 Linux 操作系统上。有一个role with AmazonECSTaskExecutionRolePolicy and this in-line policy：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Envfile",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/docker-assets/.env"
        },
        {
            "Sid": "EnvFolder",
            "Effect": "Allow",
            "Action": "s3:GetBucketLocation",
            "Resource": "arn:aws:s3:::my-bucket/docker-assets"
        }
    ]
}

ECS任务定义：

{
  "ipcMode": null,
  "executionRoleArn": "arn:aws:iam::my-account:role/ecsTaskExecutionRole",
  "containerDefinitions": [
    {
      "dnsSearchDomains": null,
      "environmentFiles": [
        {
          "value": "arn:aws:s3:::my-bucket/docker-assets/.env",
          "type": "s3"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "secretOptions": null,
        "options": {
          "awslogs-group": "/ecs/My-Task",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "ecs"
        }
      },
      "entryPoint": null,
      "portMappings": [
        {
          "hostPort": 3000,
          "protocol": "tcp",
          "containerPort": 3000
        }
      ],
      "command": null,
      "linuxParameters": null,
      "cpu": 0,
      "environment": [],
      "resourceRequirements": null,
      "ulimits": null,
      "dnsServers": null,
      "mountPoints": [],
      "workingDirectory": null,
      "secrets": null,
      "dockerSecurityOptions": null,
      "memory": null,
      "memoryReservation": null,
      "volumesFrom": [],
      "stopTimeout": null,
      "image": "my-account.dkr.ecr.us-east-1.amazonaws.com/my-app-v1:v1",
      "startTimeout": null,
      "firelensConfiguration": null,
      "dependsOn": null,
      "disableNetworking": null,
      "interactive": null,
      "healthCheck": null,
      "essential": true,
      "links": null,
      "hostname": null,
      "extraHosts": null,
      "pseudoTerminal": null,
      "user": null,
      "readonlyRootFilesystem": null,
      "dockerLabels": null,
      "systemControls": null,
      "privileged": null,
      "name": "my-app"
    }
  ],
  "placementConstraints": [],
  "memory": "512",
  "taskRoleArn": "arn:aws:iam::my-account:role/ecsTaskExecutionRole",
  "compatibilities": [
    "EC2",
    "FARGATE"
  ],
  "taskDefinitionArn": "arn:aws:ecs:us-east-1:my-account:task-definition/My-Task:5",
  "family": "My-Task",
  "requiresAttributes": [
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "ecs.capability.execution-role-awslogs"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.ecr-auth"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "ecs.capability.env-files.s3"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.task-iam-role"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "ecs.capability.execution-role-ecr-pull"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "ecs.capability.task-eni"
    }
  ],
  "pidMode": null,
  "requiresCompatibilities": [
    "FARGATE"
  ],
  "networkMode": "awsvpc",
  "runtimePlatform": null,
  "cpu": "256",
  "revision": 5,
  "status": "ACTIVE",
  "inferenceAccelerators": null,
  "proxyConfiguration": null,
  "volumes": []
}

任务定义还列出了 env 文件的 s3 ARN。
我正在使用默认 VPC 和子网运行
启用自动IP
我的 s3 存储桶创建时阻止所有公共访问

如果需要任何进一步的信息来帮助回答，请告诉我。提前致谢。

【问题讨论】：

声明“ecsTaskExecution 角色”有点令人困惑，因为 ECS 任务有两个 IAM 角色设置：“执行角色”和“任务角色”。请在您的问题中包含任务定义。
另外，正如您链接的文档顶部所述，我高度建议使用 SSM Parameter Store 或 SecretsManager 来存储这些环境变量值，而不是将它们存储在 S3 中的文件中。
我更新了您指出的令人困惑的语言。该角色具有 AmazonECSTaskExecutionRolePolicy 和与上述 JSON 的内联策略......此外，我测试了从角色到策略模拟器上的 s3 存储桶和 s3 文件的访问，这表明它们是可访问的。
如果没有看到您的 ECS 任务定义，就不可能指出您的 ECS 任务定义中是否有错误。
更新了帖子以反映我的 ECS 任务定义

标签： amazon-web-services amazon-s3 environment-variables amazon-ecs aws-fargate

【解决方案1】：

我更新了我的ecsTaskExecutionRole的内联策略覆盖桶（带斜线和不带斜线）及其下的所有内容。这似乎有效：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/docker-assets/.env"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}

【讨论】：