将 iam 用户映射到角色后权限被拒绝

Question

谁能帮我解决权限被拒绝的问题。如果有任何遗漏或错误，请告诉我。

使用以下策略创建新角色 custom-iams-orchestration-rolefor service Elastic Container Service Task

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "*"
        }
    ]
}

并通过在角色中添加以下策略来信任具有相同帐户的用户

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com",
        "AWS": "arn:aws:iam::accountid:user/iams-dev-user"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

对于用户 iams-dev-user 在策略下方添加以承担角色

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::accountid:role/custom-iams-orchestration-role"
        }
    ]
}

但是在使用用户 iams-user-dev 键从我的笔记本电脑执行 aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile iams-dev-user --region=us-east-1 时遇到问题

User:arn:aws:iam::accountid:user/iams-dev-user is not authorized to perform

Answer 1

您实际上需要assume the role 它不会自动发生。 这将为您提供访问密钥、秘密和会话令牌，然后与其他命令一起使用。如果您不想承担角色，则需要直接为用户分配策略。

示例

使用 aws cli 承担相关角色

aws sts assume-role --role-arn arn:aws:iam::accountid:role/custom-iams-orchestration-role --role-session-name orchestration-access-example --profile iams-dev-users

这将为您提供包含新的访问密钥、Secret和会话令牌的输出：

"Credentials": {
    "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
    "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=",
    "Expiration": "2016-03-15T00:05:07Z",
    "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"
}

在您的凭据文件中使用这些值：

[assumed-role]
aws_access_key_id = ASIAJEXAMPLEXEG2JICEA
aws_secret_access_key = 9drTJvcXLB89EXAMPLELB8923FB892xMFI
aws_session_token = AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=

使用这个临时配置文件执行所需的命令，如下所示：

aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile assumed-role --region=us-east-1