amazon-web-services - 用户 : x is not authorized to perform: (sts:DecodeAuthorizationMessage)`

Question

我在尝试通过 Terraform 配置我的 EC2 实例时遇到问题。但是，为了调试该问题，我正在尝试解码编码的授权失败消息。
但是当尝试调用该 sts 解码 API 时，我得到:

Error: A client error (AccessDenied) occurred when calling the DecodeAuthorizationMessage operation: User: xxx is not authorized to perform: (sts:DecodeAuthorizationMessage)

现在我不知道应该给我的 IAM 用户哪个特定权限才能解码此消息？
更新:

Answer 1

根据引用的错误消息，似乎需要 sts:DecodeAuthorizationMessage 权限:

Decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request.

随后，您可以将以下策略作为 inline policy 添加到您的 IAM 用户或其组中:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowStsDecode",
            "Effect": "Allow",
            "Action": "sts:DecodeAuthorizationMessage",
            "Resource": "*"
        }
    ]
}

如果不需要内联策略，可以通过 Customer Managed Policy 添加相同的内容。