amazon-web-services - 将快照从 S3 恢复到 AWS 托管的 Elasticsearch 时安全 token 服务异常

Question

我有一个 AWS 托管的 Elasticsearch 服务(比如 smallES)，它附加了一个正常工作的 S3 存储桶，其中包含过去 1 年的逐日滚动索引。出于某种商业原因，我创建了另一个 AWS 托管 ES 集群(比如 bigES )。我想从 bucket 恢复过去 1 年的数据进入 bigES .保证smallES bigES和 bucket都在同一个区域和同一个 VPC。

所以，我创建了一个策略:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions"
            ],
            "Resource": [
                "arn:aws:s3:::bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::bucket/*"
            ]
        }
    ]
}

并附加了带有角色的策略。该角色的信任关系为

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
       }
    ]
}

现在，当我在同一个 VPC 中通过 http 请求创建快照时，它可以为 bigES 创建一个快照存储库。我也可以查询

curl -XGET 'http://bigESid.region.es.amazonaws.com:80/_snapshot'

输出

{
    "snapshot-repo": {
        "type": "s3",
        "settings": {
            "bucket": "bucket",
            "region": "region",
            "role_arn": "role_arn"
        }
    }
}

但是当我尝试查看此快照存储库中的快照时，出现错误(如下所述)

curl -XGET 'http://bigESid.region.es.amazonaws.com:80/_cat/snapshots/snapshot-repo'

我收到以下错误:

{
    "error": {
        "root_cause": [
            {
                "type": "a_w_s_security_token_service_exception",
                "reason": "User: arn:aws:sts::acountid:assumed-role/cp-sts-grant-role/swift-region-prod-365021432299 is not authorized to perform: sts:AssumeRole on resource: role-arn (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: some-id)"
            }
        ],
        "type": "a_w_s_security_token_service_exception",
        "reason": "User: arn:aws:sts::acountid:assumed-role/cp-sts-grant-role/swift-region-prod-365021432299 is not authorized to perform: sts:AssumeRole on resource: role-arn (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: some-id)"
    },
    "status": 500
}

我已将 s3 的所有访问权限授予我的角色，但没有运气。我已经在 VPC 内发布了来自 ec2 机器的所有 http 请求。

还要提一下，如果我像下面这样查询，我会看到预期的结果

curl -XGET 'http://smallESid.region.es.amazonaws.com:80/_cat/snapshots/snapshot-repo'

IDK 为什么我尝试制作一个具有信任关系的角色，如下所示。仍然没有运气。

{
    "Version": "2012-10-17",
    "Statement": [
      {
          "Effect": "Allow",
          "Principal": {
              "Service": "ec2.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
      }
    ]
}

在此先感谢您的任何帮助/建议。

Answer 1

我使用以下策略解决了这个问题

{
"Statement": [
    {
        "Action": [
            "s3:ListBucket",
            "s3:GetBucketLocation",
            "s3:ListBucketMultipartUploads",
            "s3:ListBucketVersions"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::bucket-name"
        ]
    },
    {
        "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:DeleteObject",
            "s3:AbortMultipartUpload",
            "s3:ListMultipartUploadParts",
            "iam:PassRole"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::bucket-name/*"
        ]
    }
],
"Version": "2012-10-17"
}

然后我将策略附加到角色。我想 "iam:PassRole"已经完成了工作。