使用标准角色部署AWS数据管道



尝试简单地部署以前有效的数据管道定义。这一次,我改变了角色,以与另一个AWS(生产与分期)帐户保持一致。

当我通过AWS CLI进行部署时,我会收到以下消息:

{
    "validationErrors": [
        {
            "errors": [
                "Please add following permissions to the role ('DataPipelineDefaultRole') for uploading logs to s3: s3:Get*,s3:List*,s3:Put*"
            ], 
            "id": "EC2_Box_TaskRunner"
        }
    ], 
    "errored": true, 
    "validationWarnings": []
}

以下是DataPipelineDefaultRole:的定义

{                                                                                                                                                                                          
    "Statement": [                                                                                                                                                                         
        {                                                                                                                                                                                  
            "Action": [                                                                                                                                                                    
                "s3:*",                                                                                                                                                         
                "dynamodb:DescribeTable",                                                                                                                                                  
                "dynamodb:Scan",                                                                                                                                                           
                "dynamodb:Query",                                                                                                                                                          
                "dynamodb:GetItem",                                                                                                                                                        
                "dynamodb:BatchGetItem",                                                                                                                                                   
                "dynamodb:UpdateTable",
                "ec2:*",
                "elasticmapreduce:*",                                                                                                                                                      
                "rds:DescribeDBInstances",                                                                                                                                                 
                "rds:DescribeDBSecurityGroups",                                                                                                                                            
                "redshift:DescribeClusters",                                                                                                                                               
                "redshift:DescribeClusterSecurityGroups",                                                                                                                                  
                "sns:GetTopicAttributes",                                                                                                                                                  
                "sns:ListTopics",                                                                                                                                                          
                "sns:Publish",                                                                                                                                                             
                "sns:Subscribe",                                                                                                                                                           
                "sns:Unsubscribe",                                                                                                                                                         
                "iam:PassRole",                                                                                                                                                            
                "iam:ListRolePolicies",                                                                                                                                                    
                "iam:GetRole",                                                                                                                                                             
                "iam:GetRolePolicy",                                                                                                                                                       
                "iam:ListInstanceProfiles",                                                                                                                                                
                "cloudwatch:*",                                                                                                                                                            
                "datapipeline:*"                                                                                                                                          
            ],                                                                                                                                                                             
            "Effect": "Allow",                                                                                                                                                             
            "Resource": [                                                                                                                                                                  
                "*"                                                                                                                                                                        
            ]                                                                                                                                                                              
        }                                                                                                                                                                                  
    ]                                                                                                                                                                                      
}

我还注意到,当我尝试重新创建"DataPipelineDefaultRole"时,有时"实例配置文件ARN(s)"为空。最后,我能够通过"你好世界数据管道模板"设置和/或手动步骤的组合来重新创建这个角色。(存在实例ARN)

即使角色设置为:

{                                                                                                                                                                                          
    "Statement": [                                                                                                                                                                         
        {                                                                                                                                                                                  
            "Action": [                                                                                                                                                                    
                "*"                                                                                                                                          
            ],                                                                                                                                                                             
            "Effect": "Allow",                                                                                                                                                             
            "Resource": [                                                                                                                                                                  
                "*"                                                                                                                                                                        
            ]                                                                                                                                                                              
        }                                                                                                                                                                                  
    ]                                                                                                                                                                                      
}

它不起作用。

我做错了什么?

好的,问题是管道定义中其他对象中引用的s3路径,而不是角色或EC2_Box_TaskRunner框

相关内容

  • 没有找到相关文章

最新更新