0

我们在 ECS Fargate 容器中有以下代码，但它不断返回错误。当使用 IAM 身份验证和正确的角色设置在 lambda 中运行相同的代码时，我能够成功运行它。

错误

Network error: Response not successful: Received status code 403
UnrecognizedClientException
The security token included in the request is invalid.

代码

import 'isomorphic-fetch';
import AWSAppSyncClient, { AUTH_TYPE } from 'aws-appsync';
import AWS from 'aws-sdk';

// Setup variables for client
const graphqlEndpoint = process.env.GRAPHQL_ENDPOINT;
const awsRegion = process.env.AWS_DEFAULT_REGION;

const client = new AWSAppSyncClient({
    url: graphqlEndpoint,
    region: awsRegion,
    auth: {
        type: AUTH_TYPE.AWS_IAM,
        credentials: AWS.config.credentials,
    },
    disableOffline: true,
})

云形成

  TaskDefinition:
    Type: "AWS::ECS::TaskDefinition"
    Properties:
      ContainerDefinitions:
        - Ommitted
      Cpu: !FindInMap [CpuMap, !Ref Cpu, Cpu]
      ExecutionRoleArn: !GetAtt "TaskExecutionRole.Arn"
      Family: !Ref "AWS::StackName"
      Memory: !FindInMap [MemoryMap, !Ref Memory, Memory]
      NetworkMode: awsvpc
      RequiresCompatibilities: [FARGATE]
      TaskRoleArn: !GetAtt "TaskRole.Arn"
  TaskRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: "ecs-tasks.amazonaws.com"
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AWSAppSyncInvokeFullAccess" # Invoke Access for AppSync
4

1 回答 1

0

我最终发现这是 AppSyncClient 无法在 ECS 中正确加载凭据的结果。

根据ECS 中有关 IAM 角色的AWS Docs ，凭证的加载方式与其他 AWS 服务不同。Amazon ECS 代理没有在 env var 中填充凭证，而是使用凭证AWS_CONTAINER_CREDENTIALS_RELATIVE_URI的路径填充变量。通过首先手动加载AWSAppSyncClient凭据IAM并将其传递给. 下面的例子有效。ECSECSAWSAppSyncClient

// AWSAppSyncClient needs to be provided ECS IAM credentials explicitly
const credentials = new AWS.ECSCredentials({
  httpOptions: { timeout: 50000 },
  maxRetries: 10,
});
AWS.config.credentials = credentials;

// Setup AppSync Config
const AppSyncConfig = {
  url: graphqlEndpoint,
  region: awsRegion,
  auth: {
    type: AUTH_TYPE.AWS_IAM,
    credentials: AWS.config.credentials,
  },
  disableOffline: true,
};
于 2021-08-13T10:04:47.957 回答