python - Spectrum S3 访问被拒绝

Question

NI 正在尝试通过 Redshift Spectrum 将 parquet 数据加载到 Redshift 中。

我已经设置了信任关系等，并且可以很好地承担 Redshift 的角色。

但是我收到了 S3 访问被拒绝错误，但我似乎无法解决该错误。

S3 存储桶策略:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<BUCKET>",
                "arn:aws:s3:::<BUCKET>/*"
            ],
            "Condition": {
                "ArnEquals": {
                    "aws:PrincipalArn": [
                        "<ADMIN ROLE 1 ARN>",
                        "<ADMIN ROLE 2 ARN>"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetBucketNotification",
                "s3:GetBucketVersioning",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:ListBucketVersions"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET>",
                "arn:aws:s3:::<BUCKET>/*"
            ],
            "Condition": {
                "ArnEquals": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::123456781234:role/GlueRole",
                        "arn:aws:iam::123456781234:role/ExtractSQLRole",
                        "arn:aws:iam::123456781234:role/RedshiftRole"
                    ]
                }
            }
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<BUCKET>/*",
                "arn:aws:s3:::<BUCKET>"
            ],
            "Condition": {
                "ArnNotEquals": {
                    "aws:PrincipalArn": [
                        "<ADMIN ROLE 1 ARN>",
                        "<ADMIN ROLE 2 ARN>",
                        "arn:aws:iam::123456781234:role/GlueRole",
                        "arn:aws:iam::123456781234:role/ExtractSQLRole",
                        "arn:aws:iam::123456781234:role/RedshiftRole"
                    ]
                }
            }
        }
    ]
}

频谱架构创建方式:

create external schema 'Schema1'
from data catalog
database 'spectrum_database'
iam_role 'arn:aws:iam::123456781234:role/RedshiftRole'
catalog_role 'arn:aws:iam::123456781234:role/GlueRole'

胶水作用:

  GlueRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: glue.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              Service: redshift.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId:
                  - arn:aws:iam::123456781234:role/GlueRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole

这样我得到了一个表列表，但总是出现这个错误:

我需要将存储桶仅固定到某些角色，但还需要 Spectrum 来查询它...有什么建议吗？

Answer 1

您对所有原则都明确否认:

{
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<BUCKET>/*",
                "arn:aws:s3:::<BUCKET>"
            ],
            "Condition": {
                "ArnEquals": {
                    "aws:PrincipalArn": [
                        "<ADMIN ROLE 1 ARN>",
                        "<ADMIN ROLE 2 ARN>",
                        "arn:aws:iam::123456781234:role/GlueRole",
                        "arn:aws:iam::123456781234:role/ExtractSQLRole",
                        "arn:aws:iam::123456781234:role/RedshiftRole"
                    ]
                }
            }
        }

拒绝总是获胜，因此您将始终被拒绝，并且任何允许都不会改变它。我不确定你想通过这种明确的拒绝达到什么目的。也许您想使用ArnNotEquals？