时间戳

首页 > 解决方案 > 将快照从 S3 还原到 AWS 托管弹性搜索时出现安全令牌服务异常

amazon-web-services - 将快照从 S3 还原到 AWS 托管弹性搜索时出现安全令牌服务异常

问题描述

我有一个 AWS 托管的 Elasticsearch 服务（比如smallES），它有一个正常工作的 S3 存储桶，附加到包含过去 1 年的按日滚动索引。bigES出于某种业务原因，我创建了另一个 AWS 托管 ES 集群（例如）。我想将过去 1 年的数据bucket从bigES. 保证所有都在同一个区域和同一个 VPC 中smallES bigES。bucket

所以，我创建了一个策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions"
            ],
            "Resource": [
                "arn:aws:s3:::bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::bucket/*"
            ]
        }
    ]
}

并附加了具有角色的策略。该角色的信任关系是

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
       }
    ]
}

现在，当我在同一个 VPC 中通过 http 请求创建快照时，它可以bigES为

curl -XGET 'http://bigESid.region.es.amazonaws.com:80/_snapshot'

输出

{
    "snapshot-repo": {
        "type": "s3",
        "settings": {
            "bucket": "bucket",
            "region": "region",
            "role_arn": "role_arn"
        }
    }
}

但是当我尝试查看此快照存储库中的快照时，出现错误（如下所述）

curl -XGET 'http://bigESid.region.es.amazonaws.com:80/_cat/snapshots/snapshot-repo'

我收到以下错误：

{
    "error": {
        "root_cause": [
            {
                "type": "a_w_s_security_token_service_exception",
                "reason": "User: arn:aws:sts::acountid:assumed-role/cp-sts-grant-role/swift-region-prod-365021432299 is not authorized to perform: sts:AssumeRole on resource: role-arn (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: some-id)"
            }
        ],
        "type": "a_w_s_security_token_service_exception",
        "reason": "User: arn:aws:sts::acountid:assumed-role/cp-sts-grant-role/swift-region-prod-365021432299 is not authorized to perform: sts:AssumeRole on resource: role-arn (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: some-id)"
    },
    "status": 500
}

我已将 s3 的所有访问权限授予我的角色，但没有运气。我已经发布了来自 VPC 内 ec2 机器的所有 http 请求。

还要提一下，如果我像下面这样查询，我会看到预期的结果

curl -XGET 'http://smallESid.region.es.amazonaws.com:80/_cat/snapshots/snapshot-repo'

IDK 为什么我尝试制作一个具有如下信任关系的角色。仍然没有运气。

{
    "Version": "2012-10-17",
    "Statement": [
      {
          "Effect": "Allow",
          "Principal": {
              "Service": "ec2.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
      }
    ]
}

提前感谢您的任何帮助/建议。

标签： amazon-web-serviceselasticsearchamazon-s3amazon-elasticsearch

解决方案

我遇到了同样的问题，这是因为我不允许 Elasticsearch 服务承担这个角色。我必须更新我的信任关系政策文件以包含es.amazonaws.com.

{
  "Version": "2012-10-17",
   "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "es.amazonaws.com",
          "ec2.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

推荐阅读