Question

我正在尝试使用此模板在cloudformation构建期间从S3存储桶下载文件。

失败并显示以下错误消息。

不支持您提供的授权机制。请使用AWS4-HMAC-SHA256。

使用此模板

https://raw.githubusercontent.com/awslabs/aws-hangouts/master/20140130_cfn/s3-role-authentication.json

 2017-08-26 03:13:38,763 [ERROR] Unhandled exception during build: Failed to retrieve https://hello.s3.amazonaws.com/index.html: HTTP Error 400 : <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidRequest</Code><Message>The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256.</Message><RequestId>5328A90F4EBF081D</RequestId><HostId>nUyURkNRX7Ty5xU1LiY3wO/aFDzjiWYw9JWq0PlVdmjMCqUP7sG8FN1w5BwmtEWc8IKpeMqkv6k=</HostId></Error>
Traceback (most recent call last):
  File "/opt/aws/bin/cfn-init", line 171, in <module>
    worklog.build(metadata, configSets)
  File "/usr/lib/python2.7/site-packages/cfnbootstrap/construction.py", line 129, in build
    Contractor(metadata).build(configSets, self)

Answer 1

以下是从私有S3下载文件的正确步骤。

https://aws.amazon.com/blogs/devops/authenticated-file-downloads-with-cloudformation/

Answer 2

我还会收到“ AWS4-HMAC-SHA256”错误，我将解释这种情况以及如何解决此问题，因此它将对某人有所帮助。发生错误是因为我的存储桶所在的区域与我配置我的cloudformation堆栈的区域不同。

使用https://<bucket-region>amazonaws.com/<bucket>/<file-name>作为存储段对象的网址
您需要在实例配置文件中已用于EC2实例的“身份验证”部分中使用相同角色。

这是cloudformation模板

Resources:
  MyEC2:
    Type: "AWS::EC2::Instance"
    Properties:
      IamInstanceProfile: !Ref IAMRoleS3FullAccessInstanceProfile 
    ......
    Metadata:
      AWS::CloudFormation::Authentication:
        S3BucketAccessCredential:
          type: "S3"
          roleName: !Ref IAMRoleS3FullAccess

      AWS::CloudFormation::Init:
        config:
          .....
          files:
            /etc/nginx/sites-available/webserver:
              source: "https://<bucket-region>amazonaws.com/<bucket>/<file-name>"
              mode: "000600"
              owner: root
              group: root
              authentication: "S3BucketAccessCredential"

  # S3 Access role
  IAMRoleS3FullAccess:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns: 
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"

  # Instance profile
  IAMRoleS3FullAccessInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
      - !Ref IAMRoleS3FullAccess

来自私有S3 AWS4-HMAC-SHA256的AWS Cloudformation下载文件

2 个答案: