java - AWS S3 - com.amazonaws.AmazonServiceException : Request ARN is invalid

Question

我正在尝试让我的 Android 应用程序从 AWS S3 下载图像。但是，不断出现以下异常:

com.amazonaws.AmazonServiceException: Request ARN is invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: ValidationError; Request ID: 3481bd5f-1db2-11e5-8442-cb6f713243b6)
            at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(AmazonHttpClient.java:710)
            at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:385)
            at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:196)
            at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.invoke(AWSSecurityTokenServiceClient.java:875)
            at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.assumeRoleWithWebIdentity(AWSSecurityTokenServiceClient.java:496)
            at com.amazonaws.auth.CognitoCredentialsProvider.populateCredentialsWithSts(CognitoCredentialsProvider.java:671)
            at com.amazonaws.auth.CognitoCredentialsProvider.startSession(CognitoCredentialsProvider.java:555)
            at com.amazonaws.auth.CognitoCredentialsProvider.refresh(CognitoCredentialsProvider.java:503)
            at com.application.app.utils.helper.S3Utils.getCredProvider(S3Utils.java:35)
            at com.application.app.utils.helper.S3Utils.getS3Client(S3Utils.java:45)
            at com.application.app.integration.volley.CustomImageRequest.parseNetworkError(CustomImageRequest.java:73)
            at com.android.volley.NetworkDispatcher.parseAndDeliverNetworkError(NetworkDispatcher.java:144)
            at com.android.volley.NetworkDispatcher.run(NetworkDispatcher.java:135)

我有一个存储桶和一个身份池。此外，还创建了所需的角色。

我的 Cognito_APPUnauth_Role 具有以下内联策略:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1435504517000",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ]
        }
    ]
}

我有一个名为 S3Utils 的 java 类，它有一些辅助方法。

public class S3Utils {
    private static AmazonS3Client sS3Client;

    private static CognitoCachingCredentialsProvider sCredProvider;

    public static CognitoCachingCredentialsProvider getCredProvider(Context context){
        if (sCredProvider == null) {
            sCredProvider = new CognitoCachingCredentialsProvider(
                    context,
                    Definitions.AWS_ACCOUNT_ID,
                    Definitions.COGNITO_POOL_ID,
                    Definitions.COGNITO_ROLE_UNAUTH,
                    null,
                    Regions.US_EAST_1
            );
        }

        sCredProvider.refresh();
        return sCredProvider;
    }

    public static String getPrefix(Context context) {
        return getCredProvider(context).getIdentityId() + "/";
    }

    public static AmazonS3Client getS3Client(Context context) {
        if (sS3Client == null) {
            sS3Client = new AmazonS3Client(getCredProvider(context));
        }
        return sS3Client;
    }

    public static String getFileName(String path) {
        return path.substring(path.lastIndexOf("/") + 1);
    }

    public static boolean doesBucketExist() {
        return sS3Client.doesBucketExist(Definitions.BUCKET_NAME.toLowerCase(Locale.US));
    }

    public static void createBucket() {
        sS3Client.createBucket(Definitions.BUCKET_NAME.toLowerCase(Locale.US));
    }

    public static void deleteBucket() {
        String name = Definitions.BUCKET_NAME.toLowerCase(Locale.US);
        List<S3ObjectSummary> objData = sS3Client.listObjects(name).getObjectSummaries();
        if (objData.size() > 0) {
            DeleteObjectsRequest emptyBucket = new DeleteObjectsRequest(name);
            List<DeleteObjectsRequest.KeyVersion> keyList = new ArrayList<DeleteObjectsRequest.KeyVersion>();
            for (S3ObjectSummary summary : objData) {
                keyList.add(new DeleteObjectsRequest.KeyVersion(summary.getKey()));
            }
            emptyBucket.withKeys(keyList);
            sS3Client.deleteObjects(emptyBucket);
        }
        sS3Client.deleteBucket(name);
    }
}

发生异常的部分方法，在CustomImageRequest.java中:

s3Client = S3Utils.getS3Client(context);
            ObjectListing objects = s3Client.listObjects(new ListObjectsRequest().withBucketName(Definitions.BUCKET_NAME).withPrefix(this.urlToRetrieve));
            List<S3ObjectSummary> objectSummaries = objects.getObjectSummaries();
            //This isn't just an id, it is a full picture name in S3 bucket.
            for (S3ObjectSummary summary : objectSummaries)
            {
                String key = summary.getKey();
                if (!key.equals(this.urlToRetrieve)) continue;
                S3ObjectInputStream content = s3Client.getObject(Definitions.BUCKET_NAME, key).getObjectContent();
                try {
                    this.s3Image = IOUtils.toByteArray(content);

                } catch (IOException e) {
                }

                return new Object();
            }

我做错了什么导致每次都会抛出这个异常。提前致谢。

Answer 1

我猜测您指定的角色 ARN 可能有错误。角色 ARN 应该类似于

arn:aws:cognito-identity:us-east-1:ACCOUNTNUMBER:identitypool/us-east-1:UUID

如果拼写错误或遗漏部分内容，您可能会收到错误消息。您可能还想考虑使用新的 CognitoCachingCredentialsProvider 构造函数。

sCredProvider = new CognitoCachingCredentialsProvider(
                context,
                Definitions.COGNITO_POOL_ID,
                Regions.US_EAST_1
        );

但请注意，您必须确保已在 Cognito 控制台中指定您的角色 ARN，但这应该有助于防止将来出现此问题。

为了清晰起见，进行了格式设置，并补充说，如果使用新的构造函数，您需要在控制台中修改 ARN。