amazon-s3 - 亚马逊 Redshift : Acces Denied RestoreClusterSnapshotRequest

Question

我在尝试使用快照恢复集群时遇到了问题。如有任何指点，我将不胜感激。

使用的代码是:

var con = new AmazonRedshiftClient(acess_key_id, secret_acess_key, Amazon.RegionEndpoint.USWest2);

        var restore = new Amazon.Redshift.Model.RestoreFromClusterSnapshotRequest()
        {
            ClusterIdentifier = clusterIdentifier,
            SnapshotIdentifier = snapshotIdentifier,
            AvailabilityZone = "us-west-2a",
        };

        var response = con.RestoreFromClusterSnapshot(restore);

        Console.WriteLine("Cluster Status : {0}", response.Cluster.ClusterStatus);

当它调用 RestoreClusterSnapshotRequest 操作时，出现异常: “访问被拒绝。请确保您的 IAM 权限允许此操作。”

像这样为 Amazon Redshift 使用基于身份的策略(IAM 策略)政策:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "redshift:CopyClusterSnapshot",
            "redshift:RestoreFromClusterSnapshot",
            "redshift:AuthorizeSnapshotAccess",
            "redshift:RevokeSnapshotAccess"
        ],
        "Resource": [
            "arn:aws:redshift:us-west-2:{AccoundId}:*/backup-20160208-dbrd",
            "arn:aws:redshift:us-west-2: {AccoundId}:cluster:*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "redshift:DescribeClusterSnapshots"
        ],
        "Resource": [
            "*"
        ]
    }
]

谁能帮我解决这个问题..如果我在这些过程中做错了请纠正我..

提前致谢

Answer 1

如 the other answer 中的建议，你应该改变这一行:

"arn:aws:redshift:us-west-2:{AccoundId}:*/backup-20160208-dbrd",

到

"arn:aws:redshift:us-west-2:{AccoundId}:snapshot:*/backup-20160208-dbrd",

此外，通过大量试验和错误以及 AWS 支持人员的帮助，我发现您还需要多个 ec2 权限才能从快照恢复 Redshift 集群。此时的列表是:

    {
        "Sid": "",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeAccountAttributes",
            "ec2:DescribeAddresses",
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeSubnets",
            "ec2:DescribeVpcs",
            "ec2:DescribeInternetGateways"
        ],
        "Resource": "*"
    }

您可能只想执行 ec2:Describe* 以方便和/或防止将来在确切的权限集发生变化时出现这种情况。

Amazon Redshift Snapshots docs (搜索“RestoreFromClusterSnapshot”)应该会很快更新此信息。