连接到适用于SFTP的AWS Transfer [英] Connecting to AWS Transfer for SFTP

问题描述

我无法连接到 SFTP的AWS传输.我成功设置了服务器，并尝试使用WinSCP进行连接.

I am having trouble connecting to AWS Transfer for SFTP. I successfully set up a server and tried to connect using WinSCP.

我设置了具有以下信任关系的IAM角色:

I set up an IAM role with trust relationships like follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "transfer.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

我将其与范围缩小策略配对为使用主目录homebucket和主目录homedir

I paired this with a scope down policy as described in the documentation using a home directory homebucket and home directory homedir

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListHomeDir",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketAcl"
            ],
            "Resource": "arn:aws:s3:::${transfer:HomeBucket}"
        },
        {
            "Sid": "AWSTransferRequirements",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "HomeDirObjectAccess",
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObjectVersion",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:PutObjectTagging",
                "s3:PutObjectAcl",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::${transfer:HomeDirectory}*"
        }
    ]
}

我能够使用ssh密钥进行身份验证，但是在实际读取/写入文件时，我一直不断出现不透明的错误，例如错误查找homedir"和"readdir"失败.这一切都非常像我的IAM政策问题，但我无法弄清楚.

I was able to authenticate using an ssh key, but when it came to actually reading/writing files I just kept getting opaque errors like "Error looking up homedir" and failed "readdir". This all smells very much like problems with my IAM policy but I haven't been able to figure it out.

推荐答案

我们在将范围缩小策略与AWS Transfer上的用户一起使用时遇到了类似的问题.对我们有用的解决方案是创建两种不同的策略.

We had similar issues getting the scope down policy to work with our users on AWS Transfer. The solution that worked for us, was creating two different kinds of policies.

• 附加到角色的政策，该角色在整个存储桶中具有一般权限.
• 适用于用户的范围缩小策略，该策略利用了像{transfer:UserName}这样的传输服务变量.

• Policy to attach to the role which has general rights on the whole bucket.
• Scope down policy to apply to the user which makes use of the transfer service variables like {transfer:UserName}.

我们得出的结论是，也许只有附加的策略才能解析传输服务变量.我们不确定这是否正确以及这是否是最佳解决方案，因为这在允许附加范围缩小策略以创建一种管理员"用户时会带来潜在的风险.因此，我很乐意得到进一步将其锁定的输入.

We concluded that maybe only the extra attached policy is able to resolve the transfer service variables. We are not sure if this is correct and if this is the best solution, because this opens the possible risk when forgiving to attach the scope down policy to create a kind of "admin" user. So I'd be glad to get input to further lock this down a little bit.

这是查看传输用户详细信息时在控制台中的外观:

Here is how it looks in my console when looking at the transfer user details:

这是我们使用的两项政策:
附加到IAM角色的一般政策

Here are our two policies we use:
General policy to attach to IAM role

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfUserFolder",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::my-s3-bucket"
            ]
        },
        {
            "Sid": "HomeDirObjectAccess",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObjectVersion",
                "s3:DeleteObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3::: my-s3-bucket/*"
        }
    ]
}

适用于转移用户的范围缩小政策

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfUserFolder",
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::${transfer:HomeBucket}"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "${transfer:UserName}/*",
                        "${transfer:UserName}"
                    ]
                }
            }
        },
        {
            "Sid": "AWSTransferRequirements",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "HomeDirObjectAccess",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObjectVersion",
                "s3:DeleteObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::${transfer:HomeDirectory}*"
        }
    ]
}

这篇关于连接到适用于SFTP的AWS Transfer的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！