AWS:IAM 权限差异

Question

我正在使用 AWS 提供的此模板预置ECS集群。

我还想从s3存储桶添加一个文件，但是在添加以下内容时

files:
"/home/ec2-user/.ssh/authorized_keys":
mode: "000600"
owner: ec2-user
group: ec2-user
source: "https://s3-eu-west-1.amazonaws.com/mybucket/myfile"

预配失败，/var/log/cfn-init.log出现此错误

[root@ip-10-17-19-56 ~]# tail -f /var/log/cfn-init.log 
File "/usr/lib/python2.7/dist-packages/cfnbootstrap/construction.py", line 251, in build
changes['files'] = FileTool().apply(self._config.files, self._auth_config)
File "/usr/lib/python2.7/dist-packages/cfnbootstrap/file_tool.py", line 138, in apply
self._write_file(f, attribs, auth_config)
File "/usr/lib/python2.7/dist-packages/cfnbootstrap/file_tool.py", line 225, in _write_file
raise ToolError("Failed to retrieve %s: %s" % (source, e.strerror))
ToolError: Failed to retrieve https://s3-eu-west-1.amazonaws.com/mybucket/myfile: HTTP Error 403 : <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>C6CDAC18E57345BF</RequestId><HostId>VFCrqxtbAsTeFrGxp/nzgBqJdwC7IsS3phjvPq/YzhUk8zuRhemquovq3Plc8aqFC73ki78tK+U=</HostId></Error>

但是，从实例内部(没有上述部分(以下命令成功！

aws s3 cp s3://mybucket/myfile .

Answer 1

您需要使用AWS::CloudFormation::Authentication资源来指定使用 AWS：：CloudFormation：：Init 资源指定的文件或源的身份验证凭证。

例：

Metadata:
AWS::CloudFormation::Init:
...
AWS::CloudFormation::Authentication: 
S3AccessCreds: 
type: "S3"
buckets: 
- "mybucket"
roleName: 
Ref: "myRole"