amazon-web-services - 无法通过 AWS CLI 或 AWS SDK 访问 Amazon SQS

Question

我安装了 aws cli 并进行了配置。凭据文件位于 ~/.aws/credentials 下。内容如下:

[default]
aws_access_key_id = AKIA........PRYIA
aws_secret_access_key = OsLzxDH........HlPDt39lnY

这也是我在/.aws/config 下的配置文件:

[default]
output = json
region = us-west-2

我在 https://sqs.us-west-2.amazonaws.com/ 下创建了一个队列.我可以将消息发送到 SQS 管理控制台中的队列。

在 IAM 管理控制台中，我还为我的用户添加了 AmazonSQSFullAccess 策略。

但是当我想通过 amazon sqs 库(使用 java)列出队列时，出现以下错误:

Access to the resource https://sqs.us-west-2.amazonaws.com/ is denied. (Service: AmazonSQS; Status Code: 403; Error Code: AccessDenied; Request ID: 44c3b1f1-cd8b-5306-b4d3-e0af4bf4ccbe)

所以我认为库可能有问题，我尝试使用命令“aws sqs list-queues”通过 aws cli 进行访问。它抛出以下错误:

An error occurred (AccessDenied) when calling the ListQueues operation: Access to the resource https://us-west-2.queue.amazonaws.com/ is denied.

然后我添加了 --debug 选项并尝试再次获取队列列表。这是输出:

aws sqs list-queues --debug
2017-04-05 16:33:06,781 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/1.11.66 Python/2.7.10 Darwin/15.6.0 botocore/1.5.29
2017-04-05 16:33:06,782 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['sqs', 'list-queues', '--debug']
2017-04-05 16:33:06,782 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_scalar_parsers at 0x10280fa28>
2017-04-05 16:33:06,782 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider_cache at 0x102530f50>
2017-04-05 16:33:06,783 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/data/sqs/2012-11-05/service-2.json
2017-04-05 16:33:06,788 - MainThread - botocore.hooks - DEBUG - Event service-data-loaded.sqs: calling handler <function register_retries_for_service at 0x10210ac08>
2017-04-05 16:33:06,788 - MainThread - botocore.handlers - DEBUG - Registering retry handlers for service: sqs
2017-04-05 16:33:06,788 - MainThread - botocore.hooks - DEBUG - Event building-command-table.sqs: calling handler <function add_waiters at 0x102819b18>
2017-04-05 16:33:06,792 - MainThread - awscli.clidriver - DEBUG - OrderedDict([(u'queue-name-prefix', <awscli.arguments.CLIArgument object at 0x102b97090>)])
2017-04-05 16:33:06,792 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.sqs.list-queues: calling handler <function add_streaming_output_arg at 0x10280fc80>
2017-04-05 16:33:06,792 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.sqs.list-queues: calling handler <function add_cli_input_json at 0x10253ad70>
2017-04-05 16:33:06,792 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.sqs.list-queues: calling handler <function unify_paging_params at 0x102796398>
2017-04-05 16:33:06,796 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/data/sqs/2012-11-05/paginators-1.json
2017-04-05 16:33:06,796 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.sqs.list-queues: calling handler <function add_generate_skeleton at 0x102788758>
2017-04-05 16:33:06,796 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.sqs.list-queues: calling handler <bound method CliInputJSONArgument.override_required_args of <awscli.customizations.cliinputjson.CliInputJSONArgument object at 0x102b971d0>>
2017-04-05 16:33:06,796 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.sqs.list-queues: calling handler <bound method GenerateCliSkeletonArgument.override_required_args of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x102af0d90>>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.sqs.list-queues.queue-name-prefix: calling handler <function uri_param at 0x1023ca320>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.sqs.list-queues.cli-input-json: calling handler <function uri_param at 0x1023ca320>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.sqs.list-queues.generate-cli-skeleton: calling handler <function uri_param at 0x1023ca320>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event calling-command.sqs.list-queues: calling handler <bound method GenerateCliSkeletonArgument.generate_json_skeleton of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x102af0d90>>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event calling-command.sqs.list-queues: calling handler <bound method CliInputJSONArgument.add_to_call_parameters of <awscli.customizations.cliinputjson.CliInputJSONArgument object at 0x102b971d0>>
2017-04-05 16:33:06,797 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2017-04-05 16:33:06,797 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2017-04-05 16:33:06,797 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2017-04-05 16:33:06,798 - MainThread - botocore.credentials - INFO - Found credentials in shared credentials file: ~/.aws/credentials
2017-04-05 16:33:06,798 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/data/endpoints.json
2017-04-05 16:33:06,811 - MainThread - botocore.client - DEBUG - Registering retry handlers for service: sqs
2017-04-05 16:33:06,812 - MainThread - botocore.hooks - DEBUG - Event creating-client-class.sqs: calling handler <function add_generate_presigned_url at 0x1020d2c80>
2017-04-05 16:33:06,813 - MainThread - botocore.args - DEBUG - The s3 config key is not a dictionary type, ignoring its value of: None
2017-04-05 16:33:06,816 - MainThread - botocore.endpoint - DEBUG - Setting sqs timeout as (60, 60)
2017-04-05 16:33:06,816 - MainThread - botocore.hooks - DEBUG - Event before-parameter-build.sqs.ListQueues: calling handler <function generate_idempotent_uuid at 0x10210a668>
2017-04-05 16:33:06,816 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=ListQueues) (verify_ssl=True) with params: {'body': {'Action': u'ListQueues', 'Version': u'2012-11-05'}, 'url': u'https://us-west-2.queue.amazonaws.com/', 'headers': {'User-Agent': 'aws-cli/1.11.66 Python/2.7.10 Darwin/15.6.0 botocore/1.5.29'}, 'context': {'client_region': 'us-west-2', 'has_streaming_input': False, 'client_config': <botocore.config.Config object at 0x102cfe310>}, 'query_string': '', 'url_path': '/', 'method': u'POST'}
2017-04-05 16:33:06,817 - MainThread - botocore.hooks - DEBUG - Event request-created.sqs.ListQueues: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x102cfe2d0>>
2017-04-05 16:33:06,817 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
2017-04-05 16:33:06,817 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
POST
/

host:us-west-2.queue.amazonaws.com
x-amz-date:20170405T133306Z

host;x-amz-date
48a38266faf90970d6c7fea9b15e6ba366e5f6397c2970fc893f8a7b5e207bd0
2017-04-05 16:33:06,817 - MainThread - botocore.auth - DEBUG - StringToSign:
AWS4-HMAC-SHA256
20170405T133306Z
20170405/us-west-2/sqs/aws4_request
1f88edf15f91a626575611ec61a7d614afbc73e004d619fff636cecdb06134b7
2017-04-05 16:33:06,817 - MainThread - botocore.auth - DEBUG - Signature:
52b3d7ed984353964a6528741b8dfd8acef536272541e912fcc5c89f14210252
2017-04-05 16:33:06,820 - MainThread - botocore.endpoint - DEBUG - Sending http request: <PreparedRequest [POST]>
2017-04-05 16:33:06,821 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTPS connection (1): us-west-2.queue.amazonaws.com
2017-04-05 16:33:08,335 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "POST / HTTP/1.1" 403 321
2017-04-05 16:33:08,338 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-requestid': 'e107be92-7e65-535e-a29e-efcc8a36f565', 'content-length': '321', 'server': 'Server', 'connection': 'close', 'date': 'Wed, 05 Apr 2017 13:33:07 GMT', 'content-type': 'text/xml'}
2017-04-05 16:33:08,339 - MainThread - botocore.parsers - DEBUG - Response body:
<?xml version="1.0"?><ErrorResponse xmlns="http://queue.amazonaws.com/doc/2012-11-05/"><Error><Type>Sender</Type><Code>AccessDenied</Code><Message>Access to the resource https://us-west-2.queue.amazonaws.com/ is denied.</Message><Detail/></Error><RequestId>e107be92-7e65-535e-a29e-efcc8a36f565</RequestId></ErrorResponse>
2017-04-05 16:33:08,341 - MainThread - botocore.hooks - DEBUG - Event needs-retry.sqs.ListQueues: calling handler <botocore.retryhandler.RetryHandler object at 0x102af0c10>
2017-04-05 16:33:08,342 - MainThread - botocore.retryhandler - DEBUG - No retry needed.
2017-04-05 16:33:08,343 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 197, in main
    return command_table[parsed_args.command](remaining, parsed_args)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 333, in __call__
    return command_table[parsed_args.operation](remaining, parsed_globals)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 503, in __call__
    call_parameters, parsed_globals)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 622, in invoke
    client, operation_name, parameters, parsed_globals)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 634, in _make_client_call
    **parameters)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/client.py", line 253, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/client.py", line 543, in _make_api_call
    raise error_class(parsed_response, operation_name)
ClientError: An error occurred (AccessDenied) when calling the ListQueues operation: Access to the resource https://us-west-2.queue.amazonaws.com/ is denied.
2017-04-05 16:33:08,343 - MainThread - awscli.clidriver - DEBUG - Exiting with rc 255

An error occurred (AccessDenied) when calling the ListQueues operation: Access to the resource https://us-west-2.queue.amazonaws.com/ is denied.

正如您从调试日志中看到的那样，它正在尝试连接到 us-west-2.queue.amazonaws.com。但我在 sqs.us-west-2.amazonaws.com 下创建了队列。可能是它们被重定向到同一主机。

那我做错了什么？有什么想法吗？

提前致谢。

Answer 1

access denied异常的原因是除了IAM之外的每个aws服务都使用了ForceMFA。这就是我可以毫无问题地使用 IAM 命令的原因。

步骤如下:

1. 我使用以下命令创建了临时访问 key

   $ aws sts get-session-token --serial-number arn-of-the-mfa-device --token-code code-from-token

2. 然后我将输出值放入单独的配置文件(例如 mfa)中的凭据文件

   aws_access_key_id = "访问 key 作为返回输出"

   aws_secret_access_key = "Secret-access-key-as-in-returned-output"

   aws_session_token = "Session-Token-as-in-returned-output"

3. 然后我这样调用队列列表命令:

   aws sqs list-queues --profile mfa