amazon-web-services - aws 在 shell 脚本中承担角色不承担该角色

Question

我正在学习一个教程，我在其中担任 EC2 实例的角色，以便它可以访问服务。我正在关注本教程（https://medium.com/swlh/aws-iam-sumption-an-iam-role-from-an-ec2-instance-882081386c49），但是当我被困在 cli 部分时我开始运行“aws s3 ls”。只是为了让我知道它有效，我给了 AssumedRole 对 s3 的所有访问权限。

这是我的设置：

ImplicitRole // will be attached to EC2
   policy: 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::xxx:role/*"
        }
    ]
}

AssumedRole // will be the role assumed once logged in to EC2
  policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ]
        }
    ]
}

会发生什么我会在 cli 上运行以下命令

aws sts assume-role --role-arn arn:aws:iam::****:role/AssumedRole --role-session-name test-session

然后我会得到证书

{
    "Credentials": {
        "AccessKeyId": "key",
        "SecretAccessKey": "secret",
        "SessionToken": "longtoken",
        "Expiration": "2020-07-08T07:29:51+00:00"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AKDIEEOOKDLKSDJFDJ:test-session",
        "Arn": "arn:aws:sts::xxxx:assumed-role/AssumedRole/test-session"
    }
}

然后将更新变量，例如：设置 AWS_ACCESS_KEY_ID=XXXX 等

完成后，我运行以下命令，但它会给我 ListObject AccessDenied

aws s3 ls s3://bucket

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

标签： amazon-web-servicesamazon-s3amazon-iam