Spectrum S3 访问被拒绝

Question

NI 正在尝试通过 Redshift Spectrum 将 parquet 数据加载到 Redshift。

我已经建立了信任关系等，并且可以从 Redshift 担任该角色。

但是，我收到一个似乎无法解决的 S3 Access Denied 错误。

S3 存储桶策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<BUCKET>",
                "arn:aws:s3:::<BUCKET>/*"
            ],
            "Condition": {
                "ArnEquals": {
                    "aws:PrincipalArn": [
                        "<ADMIN ROLE 1 ARN>",
                        "<ADMIN ROLE 2 ARN>"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetBucketNotification",
                "s3:GetBucketVersioning",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:ListBucketVersions"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET>",
                "arn:aws:s3:::<BUCKET>/*"
            ],
            "Condition": {
                "ArnEquals": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::123456781234:role/GlueRole",
                        "arn:aws:iam::123456781234:role/ExtractSQLRole",
                        "arn:aws:iam::123456781234:role/RedshiftRole"
                    ]
                }
            }
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<BUCKET>/*",
                "arn:aws:s3:::<BUCKET>"
            ],
            "Condition": {
                "ArnNotEquals": {
                    "aws:PrincipalArn": [
                        "<ADMIN ROLE 1 ARN>",
                        "<ADMIN ROLE 2 ARN>",
                        "arn:aws:iam::123456781234:role/GlueRole",
                        "arn:aws:iam::123456781234:role/ExtractSQLRole",
                        "arn:aws:iam::123456781234:role/RedshiftRole"
                    ]
                }
            }
        }
    ]
}

频谱架构创建于：

create external schema 'Schema1'
from data catalog
database 'spectrum_database'
iam_role 'arn:aws:iam::123456781234:role/RedshiftRole'
catalog_role 'arn:aws:iam::123456781234:role/GlueRole'

胶水作用：

  GlueRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: glue.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              Service: redshift.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId:
                  - arn:aws:iam::123456781234:role/GlueRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole

有了这个我得到一个表列表，但总是这个错误：

我需要将存储桶固定到某些角色，但还需要 Spectrum 来查询它...有什么提示吗？

Answer 1

您对所有原则都有明确否认：

{
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<BUCKET>/*",
                "arn:aws:s3:::<BUCKET>"
            ],
            "Condition": {
                "ArnEquals": {
                    "aws:PrincipalArn": [
                        "<ADMIN ROLE 1 ARN>",
                        "<ADMIN ROLE 2 ARN>",
                        "arn:aws:iam::123456781234:role/GlueRole",
                        "arn:aws:iam::123456781234:role/ExtractSQLRole",
                        "arn:aws:iam::123456781234:role/RedshiftRole"
                    ]
                }
            }
        }

拒绝总是获胜，所以你将永远被拒绝，没有allow 会改变它。我不确定你想用这个明确的否认来实现什么。也许你想使用ArnNotEquals？