如何通过AWS JS SDK使用ECS凭证 [英] How to use ECS credentials with AWS JS SDK

问题描述

我正在尝试使用 AWS JS SDK 访问 S3存储桶，但没有成功.

I'm trying to access a S3 Bucket using the AWS JS SDK but without success.

我得到了一个任务定义，该定义使用一个称为Foo的任务角色.此任务角色是访问S3存储桶的附加 policy 策略:

I got a task definition that uses a task role called Foo. This task role as an attached policy to access to the S3 Bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::foo-bucket"
    }
  ]
}

它在

It says in the AWS Documentation about loading credentials from IAM roles for EC2 that I should configure my instance to use IAM roles. But I can't find anything about that in the AWS documentation.

我尝试使用 AWS.ECSCredentials class定义credentials :

I tried to define the credentials using the AWS.ECSCredentials class:

const options = {
  apiVersion: '2006-03-01',
  region: bucketSettings.region,
  credentials: new AWS.ECSCredentials({
    httpOptions: { timeout: 5000 }, // 5 second timeout
    maxRetries: 10, // retry 10 times
    retryDelayOptions: { base: 200 }, // see AWS.Config for information
  })
};

this.s3Instance = new AWS.S3(options);

当我尝试访问S3存储桶中的文件时:

When I try to access a file in the S3 Bucket:

const document = await this.s3Instance
  .getObject({ Bucket: bucketSettings.name, Key: key })
  .promise();

return document;

我仍然有一个

访问被拒绝

Access Denied

知道我在那里想念什么吗?

Any idea what I'm missing there?

推荐答案

访问S3存储桶的策略存在错误(请注意资源末尾的/*):

There was an error in the policy to access the S3 Bucket (note the /* at the end of the resource):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::foo-bucket/*"
    }
  ]
}

此外，不需要提供给AWS开发工具包的credentials选项:

Plus, the credentials option provided to the AWS SDK is not needed:

const options = {
  apiVersion: '2006-03-01',
  region: bucketSettings.region,
};

this.s3Instance = new AWS.S3(options);

这篇关于如何通过AWS JS SDK使用ECS凭证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！