Question

我无法让IAM用户承担执行步进功能的角色。

因此，我有一个IAM用户（而不是特定于root用户的IAM用户），我想编写一些.NET代码以假定存在的角色。

我想通过一些C＃代码为其分配此角色。

然后，现在我已经承担了为IAM用户运行它的角色，然后使用它的ARN执行step函数。

这是代码，主要似乎可以正常工作

using Amazon;
using Amazon.Extensions.NETCore.Setup;
using Amazon.SecurityToken;
using Amazon.SecurityToken.Model;
using Amazon.StepFunctions;
using Amazon.StepFunctions.Model;
using Newtonsoft.Json;
using SimpleStepFunction;
using System;
using System.Threading.Tasks;

namespace InvokeStatemachine
{
    class Program
    {
        static void Main(string[] args)
        {
            var options = new AWSOptions()
            {
                Profile = "default",
                Region = RegionEndpoint.EUWest2
            };

            var assumedRoleResponse = ManualAssume(options).ConfigureAwait(false).GetAwaiter().GetResult();

            var assumedCredentials = assumedRoleResponse.Credentials;

            var amazonStepFunctionsConfig = new AmazonStepFunctionsConfig { RegionEndpoint = RegionEndpoint.EUWest2 };
            using (var amazonStepFunctionsClient = new AmazonStepFunctionsClient(
               assumedCredentials.AccessKeyId,
               assumedCredentials.SecretAccessKey, amazonStepFunctionsConfig))
            {
                var state = new State
                {
                    Name = "MyStepFunctions"
                };
                var jsonData1 = JsonConvert.SerializeObject(state);
                var startExecutionRequest = new StartExecutionRequest
                {
                    Input = jsonData1,
                    Name = $"SchedulingEngine_{Guid.NewGuid().ToString("N")}",
                    StateMachineArn = "arn:aws:states:eu-west-2:<SomeNumber>:stateMachine:StateMachine-XXXXXXX"
                };
                var taskStartExecutionResponse = amazonStepFunctionsClient.StartExecutionAsync(startExecutionRequest).ConfigureAwait(false).GetAwaiter().GetResult();
            }


            Console.ReadLine();
        }


        public static async Task<AssumeRoleResponse> ManualAssume(AWSOptions options)
        {
            var stsClient = options.CreateServiceClient<IAmazonSecurityTokenService>();
            var assumedRoleResponse = await stsClient.AssumeRoleAsync(new AssumeRoleRequest()
            {
                RoleArn = "arn:aws:iam::XXXXXX:role/SimpleStepFunction-StateMachineRole-XXXXXX",
                RoleSessionName = "test"
            });

            return assumedRoleResponse;

        }
    }
}

它是一个.NET Core 2.1控制台应用程序，这是使用的Nugets

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>netcoreapp2.1</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="AWSSDK.Core" Version="3.3.29" />
    <PackageReference Include="AWSSDK.Extensions.NETCore.Setup" Version="3.3.6" />
    <PackageReference Include="AWSSDK.SecurityToken" Version="3.3.4.22" />
    <PackageReference Include="AWSSDK.StepFunctions" Version="3.3.2.24" />
    <PackageReference Include="Newtonsoft.Json" Version="11.0.2" />
  </ItemGroup>

  <ItemGroup>
    <ProjectReference Include="..\SimpleStepFunction\SimpleStepFunction.csproj" />
  </ItemGroup>

</Project>

我已经更新了我想为IAM用户承担的角色，并编辑了该角色的“信任关系”以包括IAM用户arn，类似这样的

{
  "Version": "2012-10-17",

  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "states.eu-west-2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
        {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::XXXXMyIamUSer" },
      "Action": "sts:AssumeRole"
    }
  ]
}

这让我担当了角色，如下所示

但是当我尝试执行最后一行时

amazonStepFunctionsClient.StartExecutionAsync(startExecutionRequest)
.ConfigureAwait(false).GetAwaiter().GetResult();

我收到此异常“请求中包含的安全令牌无效。”

我不知道如何解决这个问题，有人知道吗？

AWS IAM用户AssumeRole

0 个答案: