如何描述红移中的端点

Question

我有错误

"errorMessage": "调用 DescribeClusters 操作时发生错误 (AccessDenied)：用户：arn:aws:sts::XX:assumed-role/xx/axx 无权执行：redshift:DescribeClusters on resource: arn:aws:xx:*",

下面是RDS的代码

client = boto3.client('rds')
cluster_list = client.describe_db_cluster_endpoints()
print(cluster_list)

下面是redshift的代码

client = boto3.client('redshift', 'us-east-2')
cluster_list = client.describe_clusters()
print(cluster_list)

我的角色有以下服务如下

AWSTemplateFormatVersion: 2010-09-09

Parameters: 

  testlambdarole:
    Type: String
    Default: role-name
      
Resources: 

  Role:  
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref testlambdarole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'               
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - redshift.amazonaws.com
            Action: ['sts:AssumeRole']      
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
      Policies:
        - PolicyName: RdsAccess
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Action: 
                  - rds-db:connect
                Resource: "*"

Answer 1

您的 IAM 角色中缺少允许您想要在 Redshift 上执行的操作的策略，如下所示：

- PolicyName: RSDescribeClusters
  PolicyDocument: 
    Version: "2012-10-17"
    Statement: 
      - Effect: "Allow"
      Action: 
        - redshift:DescribeClusters
      Resource: "*"

从您的设置方式来看，您只是允许 Redshift 服务承担该 IAM 角色。

redshift:DescribeClusters 操作在您发布的错误消息中指定；此外，您可以在开发者文档的Actions, resources, and condition keys for Amazon Redshift 页面上找到 Redshift 支持的所有操作。

例如，如果您想为 RDS 添加一个，也可以使用它（经过测试并且有效）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "rds:DescribeDBClusterEndpoints",
            "Resource": [
                "arn:aws:rds:*:ACCOUNT_ID:cluster:*",
                "arn:aws:rds:*:ACCOUNT_ID:cluster-endpoint:*"
            ]
        }
    ]
}

您需要自己替换您的帐户 ID 和/或将其转换为 CloudFormation。