ios - AWS AppSync使用错误的Iam角色

Question

我正在使用包括dynamodb和s3以及ios的服务，用于由联合身份使用的自定义登录用户池，以为经过身份验证和未经身份验证的用户提供角色。那很好。

然后，当我使用AWS AppSync时，我只是在执行一个Mutation，并且收到一条错误消息，说无法承担角色arn:aws:iam::xxxxxxxxxx:role / xxxxxxxxx。试图供AppSync使用的arn:aws:iam:xxx / xxx角色不是我要使用的角色，并且iam角色与DynamoDb和s3由于某些原因使用的角色不同，即使我在不更改代码中使用的任何cognitoid。请参阅下面的示例代码。

 func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplicationLaunchOptionsKey: Any]?) -> Bool {
// CognitoIdentityUserPoolId is the id of the federated identity from console. works fine with all services except for AppSync by wrong Iam role being chosen
  let serviceConfiguration = AWSServiceConfiguration(region: .USEast1, credentialsProvider: nil)

  let userPoolConfiguration = AWSCognitoIdentityUserPoolConfiguration(clientId: CognitoIdentityUserPoolAppClientId, clientSecret: CognitoIdentityUserPoolAppClientSecret, poolId: CognitoIdentityUserPoolId)

  AWSCognitoIdentityUserPool.register(with: serviceConfiguration, userPoolConfiguration: userPoolConfiguration, forKey: AWSCognitoUserPoolsSignInProviderKey)

  pool = AWSCognitoIdentityUserPool(forKey: AWSCognitoUserPoolsSignInProviderKey)

  let credentialsProvider = AWSCognitoCredentialsProvider(regionType: .USEast1, identityPoolId: CognitoIdentityUserPoolId, identityProviderManager:pool)

  let configuration = AWSServiceConfiguration(region:.USEast1, credentialsProvider:credentialsProvider)

  AWSServiceManager.default().defaultServiceConfiguration = configuration

  pool?.delegate = self

  return true 
}
// In SampleViewController
  // after user signs in
  let appSyncConfig = try AWSAppSyncClientConfiguration(url: AppSyncEndpointURL, serviceRegion: CognitoIdentityUserPoolRegion, userPoolsAuthProvider: self)

  // Initialize the AWS AppSync client
  self.appSyncClient = try AWSAppSyncClient(appSyncConfig: appSyncConfig)

  // Set id as the cache key for objects
  self.appSyncClient?.apolloClient?.cacheKeyForObject = { $0["id"] }

// later on in the file....
extension SampleViewController: AWSCognitoUserPoolsAuthProvider{
  func getLatestAuthToken() -> String {
    return (myUserSess?.idToken?.tokenString)!
  }
}

为什么AWS AppSync尝试使用错误的Iam名称有任何帮助/原因吗？

Answer 1

您在哪里收到该消息？在控制台中使用查询页面时还是在客户端上？如果在控制台中，则问题可能出在数据源的IAM角色上，重新创建它或确保您具有以下信任策略可能有意义:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "appsync.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

如果在客户端上，则错误可能是在初始化Cognito身份提供程序或AppSync构造函数时出现的。