javascript - 访问被拒绝 CloudFormation 跨帐户 s3 副本

Question

我已经浏览了几个小时的文档，并不觉得自己错过了任何东西，但显然我错过了。我在源账户中有 S3 对象，我想将其复制到目标账户中的 S3 存储桶。这是我的设置(请注意，我最初故意将权限设置得非常宽松，只是为了使其正常工作。计划稍后缩小范围):

lambda 在 source_account 中由 Cloudformation 创建的 Angular 色:

CopyRole:
    Properties:
      RoleName: 'CopyRole'
      AssumeRolePolicyDocument:
        Statement:
          - Action: [ 'sts:AssumeRole' ]
            Effect: Allow
            Principal:
              Service: [ lambda.amazonaws.com ]
        Version: '2012-10-17'
      Policies:
        - PolicyDocument:
            Statement:
              - Action: [ 'logs:CreateLogStream', 'logs:PutLogEvents', 'logs:CreateLogGroup' ]
                Effect: Allow
                Resource: '*'
              - Action: [ 's3:*', 'kms:*' ]
                Effect: Allow
                Resource: '*'
              - Action: [ 'sts:AssumeRole' ]
                Effect: Allow
                Resource: '*'
          PolicyName: CopyPolicy
    Type: AWS::IAM::Role

请注意，上述 Angular 色可以承担任何其他 Angular 色。

dest_account DestAccountCopyRole 中的 IAM Angular 色应授予源存储桶(其他帐户)的读取权限和目标存储桶(同一帐户中)的写入权限

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetLifecycleConfiguration",
                "s3:GetBucketTagging",
                "s3:GetInventoryConfiguration",
                "s3:GetObjectVersionTagging",
                "s3:ListBucketVersions",
                "s3:GetBucketLogging",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetObjectVersionTorrent",
                "s3:GetObjectAcl",
                "s3:GetEncryptionConfiguration",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketRequestPayment",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketPolicyStatus",
                "s3:ListBucketMultipartUploads",
                "s3:GetObjectRetention",
                "s3:GetBucketWebsite",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:GetObjectLegalHold",
                "s3:GetBucketNotification",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "s3:GetObject",
                "s3:GetObjectTorrent",
                "s3:GetBucketCORS",
                "s3:GetAnalyticsConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:GetBucketLocation",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::source_bucket",
                "arn:aws:s3:::source_bucket/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:GetAccessPoint",
                "s3:GetAccountPublicAccessBlock",
                "s3:ListAllMyBuckets",
                "s3:ListAccessPoints",
                "s3:ListJobs"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectRetention",
                "s3:PutObjectVersionAcl",
                "s3:PutObjectVersionTagging",
                "s3:PutObjectTagging",
                "s3:PutObjectLegalHold",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::dest_account_bucket/*"
        }
    ]
}
... trust policy which allows the lambda role to assume this role
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::source_account:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

source_account 存储桶策略，允许目标账户中的 IAM Angular 色从源存储桶读取数据

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateS3Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::dest_account:role/DestAccountCopyRole"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::source_account_bucket",
                "arn:aws:s3:::source_account_bucket/*"
            ]
        }
    ]
}

dest_account 存储桶策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::dest_account:root"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::dest_account_bucket",
                "arn:aws:s3:::dest_account_bucket/*"
            ]
        }
    ]
}

我在 javascript 上运行的 lambda 能够通过承担跨帐户 Angular 色的部分，但在尝试复制数据时失败，并显示访问被拒绝

const creds = await getCredentials(destination_bucket)
                .catch((err) => {
                    console.log(err);
                    throw err;
                });
s3Dest = new aws.S3(creds);

return s3.listObjects(sourcePath).promise()
  .then(async (data) => {
     return Promise.all(data.Contents.map((item) => {
       console.log(`Copying data over`);
       s3Dest.copyObject({
         Bucket: destination_bucket,
         CopySource: copy_source,
         Key: key
       }).promise();
     }));
  }).catch((err) => {
    console.log(`Error: ${err}`);
    throw err;
  });

const getCredentials = async (bucket) => {
    return new Promise((resolve, reject) => {
        const params = {
            RoleArn: "arn:aws:iam::dest_account:role/DestAccountCopyRole",
            RoleSessionName: 'copy-test'
        };
        sts.assumeRole(params, (err, data) => {
            if (err) reject(err);
            else {
                console.log(data);
                resolve({
                    accessKeyId: data.Credentials.AccessKeyId,
                    secretAccessKey: data.Credentials.SecretAccessKey,
                    sessionToken: data.Credentials.SessionToken,
                });
            }
        });
    });
};

我认为我对 Javascript 的了解也不够，因为 cloudwatch 日志同时打印 Copying data over 和 Error: Access Denied 然后失败(我认为 Error: Access Denied 仅当 listObjects 调用失败时才会显示，但看起来它可以获取项目，只是在复制部分失败)

Answer 1

在属于不同 AWS 账户的存储桶之间复制对象(“跨账户复制”)时，一组凭证需要从源位置读取和写入<的权限/strong> 到达目的地。

由于您的代码从目标账户承担 IAM Angular 色，因此您还需要在源存储桶上创建存储桶策略，以授予该 IAM Angular 色从源存储桶读取数据的权限。

Lambda 函数使用的 IAM Angular 色有权访问源存储桶并不重要，因为copy() 操作将由从目标假定的 IAM Angular 色执行帐户，因此它不会使用分配给 Lambda 函数的 IAM Angular 色的任何权限。

此外，在授予 IAM Angular 色写入目标存储桶的权限时，通过 IAM Angular 色本身的策略授予此权限实际上是更好的做法，而不是作为桶策略。一般来说，存储桶策略仅应在授予公共(public)访问权限或跨账户访问权限时使用，而不是仅向一个用户授予权限。