Cognito/IAM 策略和 S3 Get Object

Question

我正在尝试将S3和Cognito集成到我的iOS应用程序中，到目前为止还没有成功。我相信这个错误与我的授权和不授权用户的IAM策略有关。这是我的策略:

{
  "Version": "2012-10-17",
  "Statement":
   [{
    "Effect":"Allow",
    "Action":"cognito-sync:*",
    "Resource":["arn:aws:cognito-sync:us-east-1:XXXXXXXXXXXX:identitypool/${cognito-identity.amazonaws.com:aud}/identity/${cognito-identity.amazonaws.com:sub}/*"]
  },
  {
      "Effect":"Allow",
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::my_bucket",
                   "arn:aws:s3:::my_bucket/*"]
  }
 ]
}

在这里我调用S3:

    AWSS3GetObjectRequest *getObjectRequest = [[AWSS3GetObjectRequest alloc] init];
    getObjectRequest.key = KEY;
    getObjectRequest.bucket = BUCKET;
    //default service has been configured previously
    AWSS3 *s3 = [[AWSS3 new] initWithConfiguration:[AWSServiceManager defaultServiceManager].defaultServiceConfiguration];
    [[s3 getObject:getObjectRequest] continueWithBlock:^id(BFTask *task) {
        if(task.error)
        {
            NSLog(@"Error: %@",task.error);
        }
        else
        {
            NSLog(@"Got File");
            NSData *data = [task.result body];
            NSString *urlString = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
            NSURL *url = [[NSURL alloc] initWithString:urlString];
            if ([[UIApplication sharedApplication] canOpenURL:url]) {
                [[UIApplication sharedApplication] openURL:url];
            }
        }
        return nil;
    }];

，这里是错误:

Error: Error Domain=com.amazonaws。AWSSTSErrorDomain Code=0 "AccessDenied——未被授权执行sts: presumerolewithwebidentity " UserInfo=0x10a23e0a0 {NSLocalizedDescription=AccessDenied——未被授权执行sts: presumerolewithwebidentity}

那么，我做错了什么?

Answer 1

您遇到的错误

Not authorized to perform sts:AssumeRoleWithWebIdentity

是由于您的信任策略出错，而不是您的访问策略。

这是作为Cognito安装向导的一部分创建的角色吗?你有没有以任何方式修改过这个角色?由Cognito控制台创建的角色被固定到创建它时使用的特定身份池。确保您使用的角色是与您在应用程序中使用的身份池一起创建的。