在S3上拒絕AWS EC2 IAM角色訪問

我已經啓動了IAM角色爲「webapp」的EC2實例。作用是連接的，我可以用在S3上拒絕AWS EC2 IAM角色訪問

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/webapp 
{ 
    "Code" : "Success", 
    "LastUpdated" : "2016-01-04T06:44:50Z", 
    "Type" : "AWS-HMAC", 
    "AccessKeyId" : "xxx", 
    "SecretAccessKey" : "xxx", 
    "Token" : "xxx", 
    "Expiration" : "2016-01-04T12:46:27Z" 
}

webapp的角色有一個附加條款確認爲S3

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Action": "s3:*", 
     "Resource": "*" 
    } 
    ] 
}

但我無法訪問S3上的對象。我使用AWS-PHP-SDK

require_once 'vendor/autoload.php'; 
use Aws\S3\S3Client; 

$client = S3Client::factory(array('region' => 'us-west-2','version'=>'2006-03-01')); 
    $result = $client->getObject(array(
    'Bucket' => 'test-bkt88767', 
    'Key' => "file.txt", 
)); 
echo $result['Body'] . "\n";

我得到一個403禁止

PHP Fatal error: Uncaught exception 'Aws\S3\Exception\S3Exception' with message 'Error executing "GetObject" on "https://s3-us-west-2.amazonaws.com/test-bkt88767/file.txt"; AWS HTTP error: Client error: `GET https://s3-us-west-2.amazonaws.com/test-bkt88767/file.txt` resulted in a `403 Forbidden` response: 
<?xml version="1.0" encoding="UTF-8"?> 
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>995F9A (truncated...) 
AccessDenied (client): Access Denied - <?xml version="1.0" encoding="UTF-8"?> 
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>995F9AC51CC2164F</RequestId><HostId>JPKyfP1LBLW5ky2wH9t2CEjHrKT0tI9zgyXHU/qcJWvBoOwhK7O0dzl1wCjjzV58UhKZVHXvFFg=</HostId></Error>'

我需要改變桶的權限呢？或者我正在做一些錯誤的配置。的EC2？

來源

2016-01-04 Junaid

是否AWS-PHP-SDK會自動使用該實例的角色？我在代碼中沒有看到任何明確的引用。 –

檢查s3存儲桶中的存儲桶策略，確保其上也不存在拒絕。 – strongjz

檢查IAM你的webapp的作用，應該說是這樣的：

{ 
    "Action": [ 
     "s3:ListBucket" 
    ], 
    "Resource": "arn:aws:s3:::your_bucket", 
    "Effect": "Allow" 
}, 
{ 
    "Action": [ 
     "s3:GetObject" 
    ], 
    "Resource": "arn:aws:s3:::your_bucket/*", 
    "Effect": "Allow" 
}

來源

2018-01-29 03:11:47 Nicholas

在S3上拒絕AWS EC2 IAM角色訪問

回答

相關問題