使用 API Gateway 从跨账户调用 SNS

Question

我的 AWS 账户中有一个 API 网关端点，它将调用同一地区另一个 AWS 账户中的 SNS。

我账户中API网关的访问策略如下

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "arn:aws:sns:ap-southeast-1:604970532282:PublishSourceMsgTopic"
    }
]
}

sns arn : arn:aws:sns:ap-southeast-1:604970532282:PublishSourceMsgTopic 属于同一地区的另一个 AWS 账户。

上述SNS中配置的访问策略的json为：

{
"Version": "2008-10-17",
"Id": "__default_policy_ID",
"Statement": [
 {
  "Sid": "__default_statement_ID",
  "Effect": "Allow",
  "Principal": {
    "AWS": "*"
  },
  "Action": [
    "SNS:Publish",
    "SNS:RemovePermission",
    "SNS:SetTopicAttributes",
    "SNS:DeleteTopic",
    "SNS:ListSubscriptionsByTopic",
    "SNS:GetTopicAttributes",
    "SNS:Receive",
    "SNS:AddPermission",
    "SNS:Subscribe"
  ],
  "Resource": "arn:aws:sns:ap-southeast-1:604970532282:PublishSourceMsgTopic",
  "Condition": {
    "StringEquals": {
      "AWS:SourceOwner": "604970532282"
    }
  }
},
{
  "Sid": "__console_pub_0",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::148445556582:root"
  },
  "Action": "SNS:Publish",
  "Resource": "arn:aws:sns:ap-southeast-1:604970532282:PublishSourceMsgTopic"
}
]
 }

当我调用 API 网关时，它显示以下错误：

User: arn:aws:sts::148445556582:assumed-role/api_gateway_sns_role/BackplaneAssumeRoleSession is not 
authorized to perform: SNS:Publish on resource: arn:aws:sns:ap-southeast- 
1:604970532282:PublishSourceMsgTopic

如果我提供在我的 AWS 账户中配置的 SNS 主题，我能够成功调用 SNS。

我在这里错过了什么？

Answer 1

您正在授予外部帐户的根所有者发布主题的权限，但实际发布请求使用的是 API 网关的角色。

因此，在您的访问策略中，您需要将发布权限授予 API 网关正在使用的角色，而不是 root 角色。

通常您要做的是设置“Principal”：“*”，然后在策略中的资源下添加条件以匹配从另一个帐户访问 SNS 的资源的帐户和 arn。

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "SNS:Publish",
    "Resource": "arn:aws:sns:us-east-2:444455556666:MyTopic",
    "Condition": {
      "ArnLike": {
        "aws:SourceArn": "arn:aws:cloudwatch:us-east-2:111122223333:alarm:MyAlarm"
      }
    }
  }]
}      

有几个示例访问策略here，应该会对您有所帮助。