python - 假定角色 python 错误无权执行:sts:AssumeRole 对资源:arn:aws:iam::xxxxxxxxx

Question

我已经在 EC2 上的 ubuntu 终端上执行了 Python 脚本，并且运行良好。现在我在 Azure Devops 管道中运行它，但 python 中的假定角色给出了此错误:似乎无法在 python 脚本中正确编写假定角色。与已经是主体的 Azure Pipeline 角色具有信任关系的角色。有什么帮助吗？

Traceback (most recent call last):
  File "/home/ubuntu/azp/_work/1/s/infra/step_function.py", line 16, in <module>
    assumed_role_object = sts_client.assume_role (
  File "/opt/hostedtoolcache/Python/3.8.12/x64/lib/python3.8/site-packages/botocore/client.py", line 395, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/opt/hostedtoolcache/Python/3.8.12/x64/lib/python3.8/site-packages/botocore/client.py", line 725, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::xxxxxxxxxxxxx:assumed-role/ServiceRoleForsampleAzurePipelines/i-0dabf23 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::xxxxxxxxxx:assumed-role/sample-Pipeline-Role
##[error]The process '/opt/hostedtoolcache/Python/3.8.12/x64/bin/python' failed with exit code 1

代码:Python 脚本

import os

from datetime import datetime
from typing import Tuple
import time
from time import sleep
import boto3
import json
from botocore.exceptions import ClientError


sts_client = boto3.client('sts')

   
assumed_role_object = sts_client.assume_role (
            RoleArn = 'arn:aws:iam::xxxxxxxxx:assumed-role/sample-Pipeline-Role',
            RoleSessionName = 'sample-Pipeline-Role'   
        )     
iam_client = boto3.client('iam',
                                  aws_access_key_id=assumed_role_object['Credentials']['AccessKeyId'],
                                  aws_secret_access_key=assumed_role_object['Credentials']['SecretAccessKey'],
                                  aws_session_token=assumed_role_object['Credentials']['SessionToken']
                                  )  



sf_client = boto3.client('stepfunctions',  region_name="us-west-2")
sf_output = sf_client.start_execution (
    stateMachineArn = 'arn:aws:states:us-west-2:xxxxxxxx:stateMachine:samplesPipelineOrchestration-LOs7dddd',
    name = 'samplesPipelineOrchestration-LOs7dddd',
    input = json.dumps({})
)

while True:
    time.sleep(15) 

    sf_response = sf_client.describe_execution(executionArn=sf_output['executionArn'])
    step_status = sf_response['status'] 

    print("%s: %s" % ("> Status...", step_status))

    if step_status == 'RUNNING':
        continue
    elif step_status == 'FAILED':
        raise Exception("%s: %s" % ("! ERROR ! Execution FAILED: ", sf_response))
    else: # SUCCEEDED
        break



   
    print(step_status)
    print (f'##vso[task.setvariable variable=step_status]{step_status}')

代码:管道脚本:

trigger:
  none

variables:
  - group: aws_creds_sample


pool:
  name: AWS Ubuntu 2004


   
jobs:
  - job: determine_the_stepfunction_status
    steps:

      - task: AWSAssumeRole@1
        displayName: 'Login to AWS'
        inputs:
          RoleArn: 'arn:aws:iam::$(AWS_ACCOUNT_ID):role/sample-Pipeline-Role'
          SessionName: 'sample-Pipeline-Role'
          ConfigureAWSCLIEnvironmentVariables: true
      - task: UsePythonVersion@0
        inputs:
          versionSpec: '3.8'
        
      - script: python -m pip install --upgrade pip boto3 setuptools sqlalchemy snowflake.sqlalchemy
        displayName: 'Install python tools'
 

      - task: PythonScript@0
        env:
          STEP_STATUS: $(step_status)
          
        inputs:
          scriptSource: 'filePath' 
          scriptPath: 'infra/step_function.py'# Required when scriptSource == filePath
          arguments:  --environment  $(ENVIRONMENT)
          failOnStderr: false 

Answer 1

导致此错误消息的第一个原因是对将要承担的角色的“可信关系”配置不正确。
当不满足具有 MFA 的可信关系中的附加条件时，您将收到此错误:

"Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}

要允许帐户(即使相同)承担该角色，您还必须更改该角色的信任关系。

1. 在控制台中，打开您要担任的角色。
2. 选择“信任关系”标签
3. 选择“编辑关系”
4. 为您要添加的账户添加声明(通常仅限“受信任的实体”中的 ec2 服务)。 4. 为您要添加的账户添加声明(通常仅限“受信任的实体”中的 ec2 服务)。