AWS：IAM权限差异

Question

我正在使用AWS提供的ECS模板配置this集群。

我还想从s3存储桶添加一个文件，但是在添加以下内容时

 files:
    "/home/ec2-user/.ssh/authorized_keys":
      mode: "000600"
      owner: ec2-user
      group: ec2-user
      source: "https://s3-eu-west-1.amazonaws.com/mybucket/myfile"

在/var/log/cfn-init.log中，配置失败并出现此错误

[root@ip-10-17-19-56 ~]# tail -f /var/log/cfn-init.log 
  File "/usr/lib/python2.7/dist-packages/cfnbootstrap/construction.py", line 251, in build
    changes['files'] = FileTool().apply(self._config.files, self._auth_config)
  File "/usr/lib/python2.7/dist-packages/cfnbootstrap/file_tool.py", line 138, in apply
    self._write_file(f, attribs, auth_config)
  File "/usr/lib/python2.7/dist-packages/cfnbootstrap/file_tool.py", line 225, in _write_file
    raise ToolError("Failed to retrieve %s: %s" % (source, e.strerror))
ToolError: Failed to retrieve https://s3-eu-west-1.amazonaws.com/mybucket/myfile: HTTP Error 403 : <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>C6CDAC18E57345BF</RequestId><HostId>VFCrqxtbAsTeFrGxp/nzgBqJdwC7IsS3phjvPq/YzhUk8zuRhemquovq3Plc8aqFC73ki78tK+U=</HostId></Error>

但是，从实例中（没有上面的部分），以下命令成功！

aws s3 cp s3://mybucket/myfile .

Answer 1

您需要使用AWS::CloudFormation::Authentication资源为您使用AWS :: CloudFormation :: Init资源指定的文件或源指定身份验证凭据。

例：

Metadata:
  AWS::CloudFormation::Init:
  ...
  AWS::CloudFormation::Authentication: 
    S3AccessCreds: 
      type: "S3"
      buckets: 
        - "mybucket"
      roleName: 
        Ref: "myRole"