如何在CFN脚本中访问受保护的S3文件？ [英] How can I access protected S3 files in a CFN script?

问题描述

我正在尝试在cloudformation脚本中检索文件。如果我公开提供该文件，则可以正常工作。如果文件是私有文件，则cfn脚本会失败，但是/ var / log /中会出现404错误。尝试通过wget检索文件会导致相应的403错误。

I am trying to retrieve a file in my cloudformation script. If I make the file publicly available, then it works fine. If the file is private, then the cfn script fails, but with a 404 error in /var/log/. Trying to retrieve the file via wget results in the appropriate 403 error.

如何从S3检索私有文件？

How can I retrieve private files from S3?

我的文件子句如下：

    "files" : {
      "/etc/httpd/conf/httpd.conf" : { 
        "source" : "https://s3.amazonaws.com/myConfigBucket/httpd.conf"
      }
    },

我添加了一个身份验证子句和适当的参数：

I added an authentication clause and appropriate parameter:

"Parameters" : {
  "BucketRole" : {
    "Description" : "S3 role for access to bucket",
    "Type" : "String",
    "Default" : "S3Access",
    "ConstraintDescription" : "Must be a valid IAM Role"
  }
}

    "AWS::CloudFormation::Authentication": {
      "default" : {
        "type": "s3",
        "buckets": [ "myConfigBucket" ],
        "roleName": { "Ref" : "BucketRole" }
      }
    },

我的IAM R ole看起来像：

My IAM Role looks like:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:List*"
      ],
      "Resource": "*"
    }
  ]
}

推荐答案

解决方案是将IamInstanceProfile属性添加到实例创建：

The solution is to add an IamInstanceProfile property to the instance creation:

   "Parameters" : {
     ...
     "RoleName" : {
       "Description" : "IAM Role for access to S3",
       "Type" : "String",
       "Default" : "DefaultRoleName",
       "ConstraintDescription" : "Must be a valid IAM Role"
     }
   },

   "Resources" : {
     "InstanceName" : {
       "Type" : "AWS::EC2::Instance",
       "Properties" : {
         "ImageId"             : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "64"] },
         "InstanceType"        : { "Ref" : "InstanceType" },
         "SecurityGroups"      : [ {"Ref" : "SecurityGroup"} ],
         "IamInstanceProfile"  : { "Ref" : "RoleName" },
         "KeyName"             : { "Ref" : "KeyName" }
       }
     },
     ...

这篇关于如何在CFN脚本中访问受保护的S3文件？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！