0

我有一个 Cloudformation 堆栈，例如，

---
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
  MyFavoriteActivity:
     Type: "AWS::StepFunctions::Activity"
     Properties:
       Name: "my-special-name"

  ActivityAccessRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                Fn::Sub: "arn:aws:iam::${AWS::AccountId}:user/my-special-user"
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: "Activity_Role_Policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - states:GetActivityTask
                Resource: { Ref: "MyFavoriteActivity" }

使用 Boto3，我尝试get_activity_task使用我的键调用ActivityAccessRole，

sfn_client = boto3.client('stepfunctions', **assumed_role_keys)
task = sfn_client.get_activity_task(
    activityArn='arn:aws:states:us-west-2:012345678910:activity:My-favorite-activity',
    workerName='my-worker'
)

但我得到一个错误，

An error occurred (AccessDeniedException) when calling the GetActivityTask operation:
User: arn:aws:sts::012345678910:assumed-role/some-prefix-ActivityAccessRole-some-hash/AssumeRoleSession1
is not authorized to perform: states:GetActivityTask on resource: arn:aws:states::012345678910:role/arn:aws:states:us-west-2:012345678910:activity:My-favorite-activity

我看到的问题是我从未创建过arn:aws:states::012345678910:role/arn:aws:states:us-west-2:012345678910:activity:My-favorite-activity（注意前缀）！

如何修复我的 CF 模板以提供适当的权限？

4

1 回答 1

1

这个问题非常愚蠢（或天才且记录不充分）。我需要改变我的角色，

  ActivityAccessRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                Fn::Sub: "arn:aws:iam::${AWS::AccountId}:user/frp-api-user"
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: "Activity_Role_Policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - states:GetActivityTask
                Resource:
                  - Fn::Sub: "arn:aws:states::${AWS::AccountId}:role/${MyFavoriteActivity}"
                  - { Ref: "MyFavoriteActivity" }

您应该注意最后两行的地方。出于某种原因需要添加这两种资源。真正的那个和从真空中弹出的那个。

于 2017-11-14T21:05:11.017 回答