获得“ AccessDenied”使用Cognito令牌访问S3时

问题描述

我正在尝试在存储桶上使用 listObjects操作。这是通过WebService访问的，我不想授予用户控制台访问权限。

I am trying to use "listObjects" operation on a bucket. This is accessed thru a WebService and I don't want to give user Console Access.

角色策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "cognito-identity:*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::BucketName"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "${cognito-identity.amazonaws.com:sub}/*"
                    ]
                }
            }
        }
    ]
}

信任政策

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "somevalue"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}

如果我替换 $ {cognito-identity.amazonaws.com ：sub}，然后使用实际值，否则会出现AccessDenied错误。似乎我缺少一些非常简单的东西。请帮忙。

If I replace "${cognito-identity.amazonaws.com:sub}" with actual value, then it works, otherwise it gives AccessDenied error. Seems like I am missing something very simple. Please help.

错误：

cfId:undefined
code:"AccessDenied"
extendedRequestId:undefined
message:"Access Denied"
region:null
requestId:null
retryDelay:14.650563118124381
retryable:false
statusCode:403
time:Sun May 14 2017 23:11:57 GMT+0530
name:"AccessDenied"
stack:"AccessDenied: Access Denied↵    at constructor.extractError (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:11663)↵    at constructor.callListeners (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27756)↵    at constructor.emit (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27465)↵    at constructor.emitEvent (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:15469)↵    at constructor.e (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:11925)↵    at a.runTo (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:27302)↵    at http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:27509↵    at constructor.<anonymous> (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:12135)↵    at constructor.<anonymous> (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:15524)↵    at constructor.callListeners (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27862)"
__proto__:Object

推荐答案

事实证明，这对我来说是一个愚蠢的错误，sub始终采用以下形式：
us-east-1：12345678-1234-1234-1234-123456790ab

As it turned out, it was a silly mistake from my side. Sub is always in the form :us-east-1:12345678-1234-1234-1234-123456790ab.

我从Cognito-idp复制了SUB，这是错误的。这是错误的SUB。

I was copying the SUB from Cognito-idp which was wrong. It is the wrong SUB.

SUB是我们从Cognito身份池中获得的IdentityId。

The SUB is IdentityId that we get from Cognito Identity pool.

感谢您的关注。

这篇关于获得“ AccessDenied”使用Cognito令牌访问S3时的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！