gpt4 book ai didi

javascript - AWS JS SDK、IAM 和 DynamoDB 问题

转载 作者:行者123 更新时间:2023-12-01 15:05:46 25 4
gpt4 key购买 nike

在使用 AWS JS SDK + DynamoDB 时出现此错误:

AccessDeniedException:用户:arn:aws:its::[accnt id]:assumed-role/dynamoIntroRole/web-identity 无权执行:dynamodb:PutItem 资源:arn:aws:dynamodb:us-west- 2:[accnt id]:table/websiteTest

这是我用过的 HTML/JS:

<title>Insert title here</title>
</head>
<body>
<button id="login">Login</button>
<div id="fb-root"></div>

<script type="text/javascript">
var fbUserId;
var dynamodb = null;
var appId = '120636118298132'; //from facebook
var roleArn = 'arn:aws:iam::[my account id deleted]:role/dynamoIntroRole'; //from AWS IAM

window.fbAsyncInit = function() {
FB.init({appId : appId});

document.getElementById('login').onclick = function(){

FB.login(function (response)
{
if(response.authResponse)
{
AWS.config.credentials = new AWS.WebIdentityCredentials({ //WIF
RoleArn: roleArn,
ProviderId: 'graph.facebook.com',
WebIdentityToken: response.authResponse.accessToken
});

var dynamodb = new AWS.DynamoDB({ region: 'us-west-2' });
var docClient = new AWS.DynamoDB.DocumentClient({ service: dynamodb });
console.log("You're now logged in.");
var params = {
TableName: 'websiteTest',
Item: {
itemID:'lkjljljlkjlkjlkjlkjlkj',
f2:'kjhkjhkjhkjhkjhkjhkjhkjhkjh'
}
};
docClient.put(params, function(err, data){
if (err) console.log(err);
else console.log(data);
});
}
else
{
console.log("Issue logging in");
}

}); //end fb login

};
};
// Load the FB JS SDK asynchronously
(function(d, s, id){
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) {return;}
js = d.createElement(s); js.id = id;
js.src = "//connect.facebook.net/en_US/all.js";
fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));
</script>

</body>

这是我附加到所用 Angular 色的 IAM 策略:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:DeleteItem",
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:Query",
"dynamodb:UpdateItem"
],
"Resource": [
"arn:aws:dynamodb:us-west-2:[my account deleted]:table/websiteTest"
],
"Condition": {
"ForAllValues:StringEquals": {
"dynamodb:LeadingKeys": [
"${graph.facebook.com:id}"
]
}
}
}
]
}

我错过了什么?

最佳答案

您遇到的问题与 IAM 政策中指定的条件有关。它目前指定了细粒度的访问控制。

"Condition": {
"ForAllValues:StringEquals": {
"dynamodb:LeadingKeys": [
"${graph.facebook.com:id}"
]
}
}

条件要求分区键与使用的 Facebook id 相匹配。如果您没有指定的分区键,那么它将抛出 AccessDeniedException。

因此,您需要创建一个将 Facebook ID 作为分区键的表,或者从 IAM 策略中删除该条件。另请注意,分区键必须是字符串才能使用细粒度访问控制。

资源:

Fine-Grained Access Control for DynamoDB

Example Policies for Fine-Grained Access Control

关于javascript - AWS JS SDK、IAM 和 DynamoDB 问题,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/34056857/

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com