1

我正在尝试在我的 ASP.NET MVC 项目中使用嵌入 QuickSight 仪表板 URL 功能。为了测试，我只是尝试将嵌入 URL 输出到字符串。这是我的代码的主要部分：

    var awsCredentials = new BasicAWSCredentials("redacted", "redacted");

    AmazonSecurityTokenServiceClient stsClient = new AmazonSecurityTokenServiceClient(awsCredentials);
    var tokenServiceRequest = stsClient.GetSessionToken();

    var client = new AmazonQuickSightClient(
        tokenServiceRequest.Credentials.AccessKeyId,
        tokenServiceRequest.Credentials.SecretAccessKey,
        tokenServiceRequest.Credentials.SessionToken,
        Amazon.RegionEndpoint.APSoutheast2);
    try
    {
        string machineTypeEmbedUrl =
            client.GetDashboardEmbedUrlAsync(new GetDashboardEmbedUrlRequest
            {
                AwsAccountId = "redacted",
                DashboardId = "redacted",
                IdentityType = IdentityType.IAM,
                ResetDisabled = true,
                SessionLifetimeInMinutes = 100,
                UndoRedoDisabled = false
            }).Result.EmbedUrl;
    }
    catch (Exception ex)
    {
        return new HttpStatusCodeResult(HttpStatusCode.BadRequest,ex.Message);
    }

为了支持所需的权限，我设置了一个允许 STS Assume Role 的 IAM 用户，如下所示：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1551593192075",
            "Action": [
                "sts:AssumeRole"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::redacted:role/assume-quicksight-role"
        }
    ]
}

我已经使用以下权限设置了上面指定的角色，并设置了它的信任策略，以便上面的 IAM 用户可以承担它。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "quicksight:RegisterUser",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "quicksight:GetDashboardEmbedUrl",
            "Resource": "arn:aws:quicksight:ap-southeast-2:redacted:dashboard/redacted",
            "Effect": "Allow"
        }
    ]
}

据我所知，这应该可行。调试显示我确实获得了一个传递给 embedUrl 请求的会话令牌，但是我收到以下错误：

InnerException = {“用户：arn:aws:iam:::user/api-dev-quicksight-user 无权执行：quicksight:GetDashboardEmbedUrl 资源：arn:aws:quicksight:ap-southeast-2::dashboard/ "}

我不确定为什么会这样？我有一个可以担任正确角色的用户，并且该角色对相关仪表板具有正确的权限。我在这里想念什么？

4

1 回答 1

0

尝试像这样改变你的角色（注意::前面的双冒号dashboard）：

...
"Action": "quicksight:GetDashboardEmbedUrl", 
"Resource": "arn:aws:quicksight:ap-southeast-2::dashboard/*", 
"Effect": "Allow"
...

这应该允许用户访问仪表板下的所有子资源。

要遵循 AWS 推荐的最小权限原则，您应该列出所有资源：

...
"Resource": [
    "arn:aws:quicksight:ap-southeast-2::dashboard/", 
    "arn:aws:quicksight:ap-southeast-2::dashboard/redacted"]
...
于 2019-03-03T08:07:41.883 回答