我们有一个多帐户AWS设置。每个客户负责不同的开发渠道(开发、质量保证、生产)。
我们还使用ADFS进行连接，以对这些不同的通道进行身份验证。
我将进行以下aws-cli调用来设置凭据
aws-adfs login --profile=master --adfs-host=adfs.whatever.com --no-ssl-verification
生成的凭据文件将类似于以下
[master]
aws_access_key_id = key_id
aws_secret_access_key = access_key
aws_session_token = session_token
aws_security_token = security_token
其他通道被识别为配置文件中的配置文件
[default]
[profile master]
region = us-west-2
output = text
adfs_config.ssl_verification = False
adfs_config.role_arn = arn:aws:iam::XXXXXXXXX:role/AD_DeveloperRole
adfs_config.adfs_host = adfs.whatever.com
adfs_config.adfs_user = me@whatever.com
adfs_config.session_duration = 3600
[profile development]
role_arn = arn:aws:iam::YYYYYYY:role/DeveloperRole
source_profile = master
region = us-west-2
output = json
adfs_config.ssl_verification = False
adfs_config.role_arn = arn:aws:iam::XXXXXXXXX:role/AD_DeveloperRole
adfs_config.adfs_host = adfs.whatever.com
adfs_config.adfs_user = me@whatever.com
adfs_config.session_duration = 3600
使用aws-cli，我可以通过它们的配置文件访问其他通道。以下是的示例
aws --profile=development ssm get-parameters-by-path --path /SOME_PARAMETER
但是，我想在代码中执行此操作。以下是我如何使用AWS-JAVA-SDK 复制它
String region = new AwsProfileRegionProvider("profile development").getRegion();
CsmConfigurationProvider csmConfig = new ProfileCsmConfigurationProvider("profile development");
AWSCredentialsProvider credentialsProvider = new ProfileCredentialsProvider("master");
AWSSimpleSystemsManagement ssm = AWSSimpleSystemsManagementClientBuilder.standard()
.withCredentials(credentialsProvider)
.withRegion(region)
.withClientSideMonitoringConfigurationProvider(csmConfig)
.build();
GetParametersByPathRequest request = new GetParametersByPathRequest();
request.setPath("/SOME_PARAMETER");
GetParametersByPathResult result = ssm.getParametersByPath(request);
但我收到错误信息
com.amazonaws.services.simplesystemsmanagement.model.AWSSimpleSystemsManagementException: User: arn:aws:sts::XXXXXXXXX:assumed-role/AD_DeveloperRole/me@whatever.com is not authorized to perform: ssm:GetParametersByPath on resource: arn:aws:ssm:us-west-2:XXXXXXXXX:parameter/SOME_PARAMETER (Service: AWSSimpleSystemsManagement; Status Code: 400; Error Code: AccessDeniedException; Request ID: ***********)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1660) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1324) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1074) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:745) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:719) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:701) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:669) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:651) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:515) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.doInvoke(AWSSimpleSystemsManagementClient.java:8126) ~[aws-java-sdk-ssm-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.invoke(AWSSimpleSystemsManagementClient.java:8095) ~[aws-java-sdk-ssm-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.invoke(AWSSimpleSystemsManagementClient.java:8084) ~[aws-java-sdk-ssm-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.executeGetParametersByPath(AWSSimpleSystemsManagementClient.java:5021) ~[aws-java-sdk-ssm-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.getParametersByPath(AWSSimpleSystemsManagementClient.java:4992) ~[aws-java-sdk-ssm-1.11.415.jar:na]
您会注意到，它正在尝试查找资源：arn:aws:ssm:us-west-2:XXXXXXXX:parameter/SOE_parameter，而不是资源：arn:aws:ssm:us-west-2:YYYYYY:parameter/SOE_PRAMeter
如果我用配置文件"development"而不是"master"更新ProfileCredentialsProvider，我会得到错误
java.lang.IllegalArgumentException: No AWS profile named 'development'
at com.amazonaws.auth.profile.ProfilesConfigFile.getCredentials(ProfilesConfigFile.java:158) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.auth.profile.ProfileCredentialsProvider.getCredentials(ProfileCredentialsProvider.java:161) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.getCredentialsFromContext(AmazonHttpClient.java:1186) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.runBeforeRequestHandlers(AmazonHttpClient.java:776) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:726) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:719) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:701) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:669) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:651) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:515) ~[aws-java-sdk-core-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.doInvoke(AWSSimpleSystemsManagementClient.java:8126) ~[aws-java-sdk-ssm-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.invoke(AWSSimpleSystemsManagementClient.java:8095) ~[aws-java-sdk-ssm-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.invoke(AWSSimpleSystemsManagementClient.java:8084) ~[aws-java-sdk-ssm-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.executeGetParametersByPath(AWSSimpleSystemsManagementClient.java:5021) ~[aws-java-sdk-ssm-1.11.415.jar:na]
at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.getParametersByPath(AWSSimpleSystemsManagementClient.java:4992) ~[aws-java-sdk-ssm-1.11.415.jar:na]
我需要在Java代码中更改什么，以便它访问存储在YYYYYY而不是XXXXXXXX中的参数？
在这里找到了答案aws-cli角色假设配置文件与sdk 不兼容
显然，这是在AWS Java SDK 2.x.中修复的