使用角色映射iam用户后拒绝权限

Question

有人可以帮我解决权限被拒绝的问题。如果遗漏或错误，请告诉我。

使用以下政策

为服务custom-iams-orchestration-role创建了新角色Elastic Container Service Task

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "*"
        }
    ]
}

通过在角色中添加以下政策

来信任具有相同帐户的用户

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com",
        "AWS": "arn:aws:iam::accountid:user/iams-dev-user"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

对于用户iams-dev-user添加以下政策以承担角色

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::accountid:role/custom-iams-orchestration-role"
        }
    ]
}

但是在使用用户aws sns publish --topic-arn arn:aws:sns:us-east-1:accountid:SISMANAGER-DEV-TOPIC --message testingForIamsDevUser --profile iams-dev-user --region=us-east-1密钥

从笔记本电脑执行iams-user-dev时遇到问题

User:arn:aws:iam::accountid:user/iams-dev-user is not authorized to perform

Answer 1

您需要实际assume the role它不会自动发生。 这将为您提供访问密钥，密钥和会话令牌，然后与其他命令一起使用。如果您不想承担角色，则需要直接为用户分配策略。

实施例

使用aws cli来承担有问题的角色

CREATE TABLE table1 ( 
//.. 
UNIQUE KEY `UNIQ_60349993F97DBD80` (`contrat_parent_id`) 
//.. 
)ENGINE=InnoDB AUTO_INCREMENT=4384 DEFAULT CHARSET=latin1 COLLATE=latin1_general_ci.

这将为您提供包含新的访问密钥，密钥和会话令牌的输出：

aws sts assume-role --role-arn arn:aws:iam::accountid:role/custom-iams-orchestration-role --role-session-name orchestration-access-example --profile iams-dev-users

在凭证文件中使用这些值：

"Credentials": {
    "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
    "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=",
    "Expiration": "2016-03-15T00:05:07Z",
    "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"
}

使用此临时配置文件执行所需命令，如下所示：

[assumed-role]
aws_access_key_id = ASIAJEXAMPLEXEG2JICEA
aws_secret_access_key = 9drTJvcXLB89EXAMPLELB8923FB892xMFI
aws_session_token = AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=