amazon-web-services - AWS : IAM permission discrepancies

Question

我正在使用 this 配置 ECS 集群AWS 提供的模板。

我还想从 s3 存储桶添加文件，但在添加以下内容时

 files:
    "/home/ec2-user/.ssh/authorized_keys":
      mode: "000600"
      owner: ec2-user
      group: ec2-user
      source: "https://s3-eu-west-1.amazonaws.com/mybucket/myfile"

配置失败，并在 /var/log/cfn-init.log 中出现此错误

[root@ip-10-17-19-56 ~]# tail -f /var/log/cfn-init.log 
  File "/usr/lib/python2.7/dist-packages/cfnbootstrap/construction.py", line 251, in build
    changes['files'] = FileTool().apply(self._config.files, self._auth_config)
  File "/usr/lib/python2.7/dist-packages/cfnbootstrap/file_tool.py", line 138, in apply
    self._write_file(f, attribs, auth_config)
  File "/usr/lib/python2.7/dist-packages/cfnbootstrap/file_tool.py", line 225, in _write_file
    raise ToolError("Failed to retrieve %s: %s" % (source, e.strerror))
ToolError: Failed to retrieve https://s3-eu-west-1.amazonaws.com/mybucket/myfile: HTTP Error 403 : <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>C6CDAC18E57345BF</RequestId><HostId>VFCrqxtbAsTeFrGxp/nzgBqJdwC7IsS3phjvPq/YzhUk8zuRhemquovq3Plc8aqFC73ki78tK+U=</HostId></Error>

但是从实例内部(没有上述部分)以下命令会成功!

aws s3 cp s3://mybucket/myfile .

Answer 1

您需要使用AWS::CloudFormation::Authentication资源来指定您使用 AWS::CloudFormation::Init 资源指定的文件或源的身份验证凭证。

示例:

Metadata:
  AWS::CloudFormation::Init:
  ...
  AWS::CloudFormation::Authentication: 
    S3AccessCreds: 
      type: "S3"
      buckets: 
        - "mybucket"
      roleName: 
        Ref: "myRole"