使用 boto3 从 aws 检索临时凭证时访问被拒绝错误

Question

我正在尝试使用 boto3 从 AWS 获取一组临时凭证，然后使用 this example。

import boto3
from botocore.errorfactory import ClientError

# create an STS client object that represents a live connection to the
# STS service
sts_client = boto3.client('sts')

# Call the assume_role method of the STSConnection object and pass the role
# ARN and a role session name
assumed_role_object = sts_client.assume_role(
    RoleArn="aws:iam::123456789:role/Upload_Data_To_S3",
    RoleSessionName="iam-s3-upload"
)

# From the response that contains the assumed role, get the temporary
# credentials that can be used to make subsequent API calls
credentials = assumed_role_object['Credentials']

# Use the temporary credentials that AssumeRole returns to make a
# connection to Amazon S3
s3_resource = boto3.resource(
    's3',
    aws_access_key_id=credentials['AccessKeyId'],
    aws_secret_access_key=credentials['SecretAccessKey'],
    aws_session_token=credentials['SessionToken'],
)

我收到AccessDenied 错误，上下文如下：

Exception has occurred: ClientError
An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::123456789:user/Yury is not authorized to perform: sts:AssumeRole on resource: aws:iam::123456789:role/Upload_Data_To_S3
  File "/home/ystanev/git-projects/ap_renewables/HighSpeed/s3-data-upload/s3_upload.py", line 18, in <module>
    RoleSessionName="iam-s3-upload"

我的帐号和角色上的帐号匹配，因此我不确定为什么我不能在自己的帐户下担任角色。我已经检查了 AWS 控制台下的 IAM 权限，我的帐户已附加到 IAMFullAccess 组。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:*",
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribePolicy",
                "organizations:ListChildren",
                "organizations:ListParents",
                "organizations:ListPoliciesForTarget",
                "organizations:ListRoots",
                "organizations:ListPolicies",
                "organizations:ListTargetsForPolicy"
            ],
            "Resource": "*"
        }
    ]
}

我检查了knowledge centre，但我不确定这是否适用于我的情况，因为 IAM 角色在我的帐户下。

我如何检查我是否有权担任该角色，如果我没有将其设置为允许。

谢谢，感谢您的帮助。

Answer 1

您的用户需要sts:AssumeRole 权限。我在你的政策中没有看到这一点。然后正如评论所示，您需要确保您所承担的角色的信任关系允许您的用户的帐号承担它。信任政策最终看起来像：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account number of the role>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

最佳实践是只允许您的用户的特定委托人 ARN 担任信任关系中的角色，然后在附加到您的用户的策略中，您将明确列出可以通过 sts:AssumeRole 担任的角色，而不是允许* 访问。