2
我無法讓AWS CLI從Docker容器中的S3下載文本文件。有一個VPC設置有VPC端點批准了S3政策：如何獲得VPC端點在Docker容器中工作？
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyUnEncryptedObjectUploads",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::secret-store/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
},
{
"Sid": " DenyUnEncryptedInflightOperations",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::secret-store/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
},
{
"Sid": "Access-to-specific-VPCE-only",
"Effect": "Deny",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::secret-store/*",
"Condition": {
"StringNotEquals": {
"aws:sourceVpce": "vpce-de7893b7"
}
}
}
]
}
我使用的是Dockerfile用於安裝AWS CLI和調用的入口點腳本：
FROM java:8
RUN apt-get update && \
apt-get -y install python curl unzip && cd /tmp && \
curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" \
-o "awscli-bundle.zip" && \
unzip awscli-bundle.zip && \
./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws && \
rm awscli-bundle.zip && rm -rf awscli-bundle
COPY entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
入口點腳本設置在AWS CLI配置文件並調用aws s3 cp s3://bucket/file.txt -：
#!/bin/bash
mkdir ~/.aws
echo '[default]
aws_access_key_id=
aws_secret_access_key=
output=json
region=us-west-2' > ~/.aws/config
aws --version
aws s3 cp s3://secret-store/test.txt -
當我運行在EC2 CLI入口點腳本，我得到預期的迴應授權：
[[email protected] ~]$ ./entrypoint.sh
mkdir: cannot create directory ‘/home/ec2-user/.aws’: File exists
aws-cli/1.11.22 Python/2.7.5 Linux/3.10.0-514.el7.x86_64 botocore/1.4.79
Hello secure VPC world!
但我得到一個download failed (Forbidden)錯誤，當我從同一主機上的一個碼頭工人的圖像，這是成功運行相同的腳本：
[[email protected] ~]$ docker build . -t test && docker run test
Sending build context to Docker daemon 15.89 MB
Step 1 : FROM java:8
---> 861e95c114d6
Step 2 : RUN apt-get update && apt-get -y install python curl unzip && cd /tmp && curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip" && unzip awscli-bundle.zip && ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws && rm awscli-bundle.zip && rm -rf awscli-bundle
---> Using cache
---> c948b9caeaae
Step 3 : COPY entrypoint.sh /entrypoint.sh
---> Using cache
---> 9c1774cc5d57
Step 4 : ENTRYPOINT /entrypoint.sh
---> Running in 98179b1b7172
---> d8f12456a198
Removing intermediate container 98179b1b7172
Successfully built d8f12456a198
aws-cli/1.11.22 Python/2.7.9 Linux/3.10.0-514.el7.x86_64 botocore/1.4.79
download failed: s3://secret-store/test.txt to - An error occurred (403) when calling the HeadObject operation: Forbidden
誰知道爲什麼我得到一個禁止迴應在同一主機上運行的docker容器我從中獲得成功響應？