我一直在尝试使用AWS SDK创建安全组，但不知何故它无法对其进行身份验证。对于特定的Access Key和Secret Key，我已经提供了管理权限，但也无法验证。另一方面，我在 AWS S3 示例上尝试了相同的凭证，它成功执行了。
创建安全组时出现以下错误：
com.amazonaws.AmazonServiceException: AWS was not able to validate the provided access credentials (Service: AmazonEC2; Status Code: 401; Error Code: AuthFailure; Request ID: 1584a035-9a88-4dc7-b5e2-a8b7bde6f43c)
at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(AmazonHttpClient.java:1077)
at com.amazonaws.http.AmazonHttpClient.executeOneRequest(AmazonHttpClient.java:725)
at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:460)
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:295)
at com.amazonaws.services.ec2.AmazonEC2Client.invoke(AmazonEC2Client.java:9393)
at com.amazonaws.services.ec2.AmazonEC2Client.createSecurityGroup(AmazonEC2Client.java:1146)
at com.sunil.demo.ec2.SetupEC2.createSecurityGroup(SetupEC2.java:84)
at com.sunil.demo.ec2.SetupEC2.main(SetupEC2.java:25)
这是Java代码：
public class SetupEC2 {
AWSCredentials credentials = null;
AmazonEC2Client amazonEC2Client ;
public static void main(String[] args) {
SetupEC2 setupEC2Instance = new SetupEC2();
setupEC2Instance.init();
setupEC2Instance.createSecurityGroup();
}
public void init(){
// Intialize AWS Credentials
try {
credentials = new BasicAWSCredentials("XXXXXXXX", "XXXXXXXXX");
} catch (Exception e) {
throw new AmazonClientException(
"Cannot load the credentials from the credential profiles file. " +
"Please make sure that your credentials file is at the correct " +
"location (/home/sunil/.aws/credentials), and is in valid format.",
e);
}
// Initialize EC2 instance
try {
amazonEC2Client = new AmazonEC2Client(credentials);
amazonEC2Client.setEndpoint("ec2.ap-southeast-1.amazonaws.com");
amazonEC2Client.setRegion(Region.getRegion(Regions.AP_SOUTHEAST_1));
} catch (Exception e) {
e.printStackTrace();
}
}
public boolean createSecurityGroup(){
boolean securityGroupCreated = false;
String groupName = "sgec2securitygroup";
String sshIpRange = "0.0.0.0/0";
String sshprotocol = "tcp";
int sshFromPort = 22;
int sshToPort =22;
String httpIpRange = "0.0.0.0/0";
String httpProtocol = "tcp";
int httpFromPort = 80;
int httpToPort = 80;
String httpsIpRange = "0.0.0.0/0";
String httpsProtocol = "tcp";
int httpsFromPort = 443;
int httpsToProtocol = 443;
try {
CreateSecurityGroupRequest createSecurityGroupRequest = new CreateSecurityGroupRequest();
createSecurityGroupRequest.withGroupName(groupName).withDescription("Created from AWS SDK Security Group");
createSecurityGroupRequest.setRequestCredentials(credentials);
CreateSecurityGroupResult csgr = amazonEC2Client.createSecurityGroup(createSecurityGroupRequest);
String groupid = csgr.getGroupId();
System.out.println("Security Group Id : " + groupid);
System.out.println("Create Security Group Permission");
Collection<IpPermission> ips = new ArrayList<IpPermission>();
// Permission for SSH only to your ip
IpPermission ipssh = new IpPermission();
ipssh.withIpRanges(sshIpRange).withIpProtocol(sshprotocol).withFromPort(sshFromPort).withToPort(sshToPort);
ips.add(ipssh);
// Permission for HTTP, any one can access
IpPermission iphttp = new IpPermission();
iphttp.withIpRanges(httpIpRange).withIpProtocol(httpProtocol).withFromPort(httpFromPort).withToPort(httpToPort);
ips.add(iphttp);
//Permission for HTTPS, any one can accesss
IpPermission iphttps = new IpPermission();
iphttps.withIpRanges(httpsIpRange).withIpProtocol(httpsProtocol).withFromPort(httpsFromPort).withToPort(httpsToProtocol);
ips.add(iphttps);
System.out.println("Attach Owner to security group");
// Register this security group with owner
AuthorizeSecurityGroupIngressRequest authorizeSecurityGroupIngressRequest = new AuthorizeSecurityGroupIngressRequest();
authorizeSecurityGroupIngressRequest.withGroupName(groupName).withIpPermissions(ips);
amazonEC2Client.authorizeSecurityGroupIngress(authorizeSecurityGroupIngressRequest);
securityGroupCreated = true;
} catch (Exception e) {
// TODO: handle exception
e.printStackTrace();
securityGroupCreated = false;
}
System.out.println("securityGroupCreated: " + securityGroupCreated);
return securityGroupCreated;
}
}
尝试更新您的LOCAL系统时间。
当AWS-datetime和您的日期时间之间的差异太大时，凭证将不被接受。
对于 Debian/Ubuntu 用户：
当您从未设置时区时，您可以使用
sudo dpkg-reconfigure tzdata
停止ntp-Service，因为时间差异太大，无法通过运行服务来更改。
sudo /etc/init.d/ntp stop
同步您的时间和日期（-q 设置时间并退出/仅运行一次）（-g 允许第一次调整较大）（-x 最多 600 秒/调整大差异的时间）（-n 执行不分叉/进程不会进入后台）
sudo ntpd -q -g -x -n
重启服务
sudo /etc/init.d/ntp start
检查实际系统日期时间
sudo date
将系统日期时间设置为您的硬件日期时间
sudo hwclock --systohc
显示您的硬件日期时间
sudo hwclock
“调用 [填写空白] 操作时发生客户端错误 (AuthFailure)：AWS 无法验证提供的访问凭证”
如果您对 AWS 凭证（即访问密钥和秘密密钥以及相应的配置文件名称）的有效性有信心，那么您的日期和时间偏离轨道就是一个很好的罪魁祸首。
就我而言，我很自信，但我错了——我使用了错误的钥匙。仔细检查一下也没什么坏处。
假设您创建了一个名为“guignol”的 IAM 用户。在 ~/.aws/config 中配置“guignol”，如下所示：
[profile guignol]
region = us-east-1
aws-access-key_id = AKXXXYYY...
aws-secret-key-access = ...如果您尚未安装 aws cli（命令级界面），请安装它。作为测试，运行 aws ec2 describe-instances --profile guignol 如果您收到 aws 无法验证凭证的错误消息，请运行 aws configure --profile guignol ，输入您的凭证并运行测试命令再次。
您必须指定个人资料和区域 aws ec2 描述实例 --profile nameofyourprofile --region eu-west-1
在我的例子中，我复制了 CDK 环境变量
AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAWS_SESSION_TOKEN~/aws/.credentials如果您将凭证放入 ~/.aws/credentials 中，则无需向 AmazonEC2Client 调用提供参数。如果您这样做，那么在 EC2 实例上，相同的代码将适用于假定的 STS 角色。
有关更多信息，请参阅：http://docs.aws.amazon.com/AWSSdkDocsJava/latest/DeveloperGuide/credentials.html
就我而言，终止终端并再次运行命令有帮助