Question

我正在尝试在存储桶上使用“listObjects”操作。这是通过WebService访问的，我不想给用户访问控制台。

角色政策

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "cognito-identity:*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::BucketName"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "${cognito-identity.amazonaws.com:sub}/*"
                    ]
                }
            }
        }
    ]
}

信托政策

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "somevalue"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}

如果我用实际值替换“$ {cognito-identity.amazonaws.com:sub}”，那么它可以工作，否则会给出AccessDenied错误。好像我错过了很简单的东西。请帮忙。

错误：

cfId:undefined
code:"AccessDenied"
extendedRequestId:undefined
message:"Access Denied"
region:null
requestId:null
retryDelay:14.650563118124381
retryable:false
statusCode:403
time:Sun May 14 2017 23:11:57 GMT+0530
name:"AccessDenied"
stack:"AccessDenied: Access Denied↵    at constructor.extractError (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:11663)↵    at constructor.callListeners (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27756)↵    at constructor.emit (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27465)↵    at constructor.emitEvent (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:15469)↵    at constructor.e (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:11925)↵    at a.runTo (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:27302)↵    at http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:27509↵    at constructor.<anonymous> (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:12135)↵    at constructor.<anonymous> (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:15524)↵    at constructor.callListeners (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27862)"
__proto__:Object

Answer 1

事实证明，这是我身边的一个愚蠢的错误。 Sub始终采用以下形式：我们 - 东 - 1：12345678-1234-1234-1234-123456790ab

我正在从Cognito-idp复制SUB，这是错误的。这是错误的SUB。

SUB是我们从Cognito Identity pool获得的IdentityId。

感谢您的光临。

使用Cognito Token访问S3时获取“AccessDenied”

1 个答案: