Question

我有一个与Amazon SimpleDB通信的应用程序。在localhost上运行时，一切正常，我将此webapp部署到我的Tomcat实例。

我在本地Tomcat和我部署应用程序的Elastic Beanstalk上都将AWS凭据指定为环境变量。

但是，在Elastic Beanstalk上，我得到一个Autowire异常（它是一个spring-boot应用程序），它由以下原因引起：

Caused by: com.amazonaws.AmazonServiceException: User (arn:aws:sts::295923482971:assumed-role/aws-elasticbeanstalk-ec2-role/i-b35eef66) does not have permission to perform (sdb:ListDomains) on resource (arn:aws:sdb:us-east-1:295923482971:domain/). Contact account owner. (Service: AmazonSimpleDB; Status Code: 403; Error Code: AuthorizationFailure; Request ID: a20f4ed9-a54d-ec13-2886-b5d31cce3778)
    at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(AmazonHttpClient.java:1088)
    at com.amazonaws.http.AmazonHttpClient.executeOneRequest(AmazonHttpClient.java:735)
    at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:461)
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:296)
    at com.amazonaws.services.simpledb.AmazonSimpleDBClient.invoke(AmazonSimpleDBClient.java:1021)
    at com.amazonaws.services.simpledb.AmazonSimpleDBClient.listDomains(AmazonSimpleDBClient.java:708)
    at com.amazonaws.services.simpledb.AmazonSimpleDBClient.listDomains(AmazonSimpleDBClient.java:974)
    at com.berrycloud.paypal.service.impl.SimpleDBServiceImpl.init(SimpleDBServiceImpl.java:53)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:497)
    at

这种情况发生在我正在通过以下代码自动装配类的启动期间：

  @PostConstruct
  private void init() {
    log.debug("Setting database client endpoint: {}", endpoint);
    client.setEndpoint(endpoint);

    // check if the domain exists
    log.debug("Listing existing domains...");

    final List<String> tableNames = client.listDomains().getDomainNames();
    if (!tableNames.contains(domain)) {
      // if not, create it
      log.debug("Creating domain {}", domain);
      client.createDomain(new CreateDomainRequest(domain));
    }
  }

我在本地和Elastic Beanstalk上使用相同的AWS凭据，因此我不明白为什么它在第一种情况下有效但在另一种情况下失败。有人可以帮助我吗？

Answer 1

您对用户有任何政策吗？通常，这意味着IAM政策不够好，您可以阅读更多here

您可以尝试添加：

{
   "Version": "2015-09-14",
   "Statement":[{
      "Effect":"Allow",
      "Action":"sdb:ListDomains",
      "Resource":"arn:aws:sdb:us-east-1:295923482971:domain/<youraccount>"
      }
   ]
}

Answer 2

通过使用

，甚至可以通过一种简单的方法来确定缺少哪些政策

PolicySimulator from AWS。

选择您要模拟的服务
选择与该服务相关的操作
使用现有策略或创建新的临时策略进行尝试

无法从Elastic Beanstalk连接到Amazon SimpleDB

2 个答案: