codedeploy 无法访问 s3答案

【问题标题】：codedeploy unable to access s3codedeploy 无法访问 s3
【发布时间】：2020-12-26 04:25:59
【问题描述】：

我在 Account A 上有一个 codepipeline，在 Account B 上有一个 codedeployment group。一旦编码部署组启动触发器，我就会看到以下错误 The IAM role arn:aws:iam::accountb:role/testcrss does not give you permission to perform operations in the following AWS service: Amazon S3. Contact your AWS administrator if you need help. If you are an AWS administrator, you can grant permissions to your users or groups by creating IAM policies.

我指的是aws提供的这个document，用于使用codepipeline进行aws跨账户部署，除了文档中提供的信息，我还需要配置什么吗？

附加到 testcrss 角色的政策

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:Get*",
                "s3:List*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey",
                "kms:GenerateDataKey*",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:Decrypt"
            ],
            "Resource": [
                "arn:aws:kms:us-east-2:AccountA:key/valuetest"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:Get*"
            ],
            "Resource": [
                "arn:aws:s3:::AccountA bucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::AccountA bucket"
            ]
        }
    ]
}

帐户 A 的存储桶政策

{
    "Version": "2012-10-17",
    "Id": "SSEAndSSLPolicy",
    "Statement": [
        {
            "Sid": "DenyUnEncryptedObjectUploads",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::AccountAbucket/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "aws:kms"
                }
            }
        },
        {
            "Sid": "DenyInsecureConnections",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::AccountAbucket/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::AccountB:root"
            },
            "Action": [
                "s3:Get*",
                "s3:Put*"
            ],
            "Resource": "arn:aws:s3:::AccountAbucket/*"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::AccountB:root"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::AccountAbucket"
        },
        {
            "Sid": "Cross-account permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::AccountB:role/testcrss"
            },
            "Action": [
                "s3:Get*",
                "s3:List*"
            ],
            "Resource": "arn:aws:s3:::AccountAbucket/*"
        }
    ]
}

角色 testcrss 的信任关系

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "codedeploy.amazonaws.com",
          "ec2.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

【问题讨论】：

请附上文件
@ChrisWilliams 已添加
似乎testcrss 和/或实例角色没有权限让 s3 执行部署。您可以发布角色和实例配置文件吗？
@Marcin 使用 json 策略编辑了问题
Acc A 中的存储桶策略是否允许从 Acc B 访问？

标签： amazon-web-services amazon-s3 aws-codepipeline aws-code-deploy

【解决方案1】：

问题是添加到帐户 B 的 KMS 密钥不正确，需要此密钥才能访问 帐户 A 上的 s3 存储桶。 KMS 密钥应与 Account A

上的代码管道附加的 KMS 密钥相同

【讨论】：