AWS Java SDK 按配置文件调用

Posted 2023-02-16

【中文标题】AWS Java SDK 按配置文件调用

【英文标题】：AWS Java SDK Call by Profile

【发布时间】：2019-06-16 10:38:51

【问题描述】：

我们有一个多账户 AWS 设置。每个帐户负责不同的开发通道（DEV、QA、生产）。

我们还使用 ADFS 连接以对这些不同的通道进行身份验证。

我将进行以下 aws cli 调用来设置凭据

aws-adfs login --profile=master --adfs-host=adfs.whatever.com --no-ssl-verification

生成的凭据文件如下所示

[master]
aws_access_key_id = key_id
aws_secret_access_key = access_key
aws_session_token = session_token
aws_security_token = security_token

其他通道在配置文件中被标识为配置文件

[default]

[profile master]
region = us-west-2
output = text
adfs_config.ssl_verification = False
adfs_config.role_arn = arn:aws:iam::XXXXXXXXX:role/AD_DeveloperRole
adfs_config.adfs_host = adfs.whatever.com
adfs_config.adfs_user = [e-mail]
adfs_config.session_duration = 3600

[profile development]
role_arn = arn:aws:iam::YYYYYYY:role/DeveloperRole
source_profile = master
region = us-west-2
output = json
adfs_config.ssl_verification = False
adfs_config.role_arn = arn:aws:iam::XXXXXXXXX:role/AD_DeveloperRole
adfs_config.adfs_host = adfs.whatever.com
adfs_config.adfs_user = [e-mail]
adfs_config.session_duration = 3600

使用 aws cli，我可以通过他们的个人资料访问其他通道。这是一个例子

aws --profile=development ssm get-parameters-by-path --path /SOME_PARAMETER

但是，我想在代码中执行此操作。这是我使用 AWS-JAVA-SDK 复制它的方式

String region = new AwsProfileRegionProvider("profile development").getRegion();
CsmConfigurationProvider csmConfig = new ProfileCsmConfigurationProvider("profile development");
AWSCredentialsProvider credentialsProvider = new ProfileCredentialsProvider("master");

AWSSimpleSystemsManagement ssm = AWSSimpleSystemsManagementClientBuilder.standard()
.withCredentials(credentialsProvider)
.withRegion(region)
.withClientSideMonitoringConfigurationProvider(csmConfig)
.build();

GetParametersByPathRequest request = new GetParametersByPathRequest();
request.setPath("/SOME_PARAMETER");
GetParametersByPathResult result = ssm.getParametersByPath(request);

但我收到错误消息

com.amazonaws.services.simplesystemsmanagement.model.AWSSimpleSystemsManagementException: User: arn:aws:sts::XXXXXXXXX:assumed-role/AD_DeveloperRole/[e-mail] is not authorized to perform: ssm:GetParametersByPath on resource: arn:aws:ssm:us-west-2:XXXXXXXXX:parameter/SOME_PARAMETER (Service: AWSSimpleSystemsManagement; Status Code: 400; Error Code: AccessDeniedException; Request ID: ***********)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1660) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1324) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1074) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:745) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:719) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:701) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:669) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:651) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:515) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.doInvoke(AWSSimpleSystemsManagementClient.java:8126) ~[aws-java-sdk-ssm-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.invoke(AWSSimpleSystemsManagementClient.java:8095) ~[aws-java-sdk-ssm-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.invoke(AWSSimpleSystemsManagementClient.java:8084) ~[aws-java-sdk-ssm-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.executeGetParametersByPath(AWSSimpleSystemsManagementClient.java:5021) ~[aws-java-sdk-ssm-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.getParametersByPath(AWSSimpleSystemsManagementClient.java:4992) ~[aws-java-sdk-ssm-1.11.415.jar:na]

您会注意到它正在尝试查找资源：arn:aws:ssm:us-west-2:XXXXXXXXX:parameter/SOME_PARAMETER 而不是资源：arn:aws :ssm:us-west-2:YYYYYY:parameter/SOME_PARAMETER

如果我使用配置文件“开发”而不是“主”更新 ProfileCredentialsProvider，我会收到错误

java.lang.IllegalArgumentException: No AWS profile named 'development'
    at com.amazonaws.auth.profile.ProfilesConfigFile.getCredentials(ProfilesConfigFile.java:158) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.auth.profile.ProfileCredentialsProvider.getCredentials(ProfileCredentialsProvider.java:161) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.getCredentialsFromContext(AmazonHttpClient.java:1186) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.runBeforeRequestHandlers(AmazonHttpClient.java:776) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:726) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:719) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:701) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:669) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:651) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:515) ~[aws-java-sdk-core-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.doInvoke(AWSSimpleSystemsManagementClient.java:8126) ~[aws-java-sdk-ssm-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.invoke(AWSSimpleSystemsManagementClient.java:8095) ~[aws-java-sdk-ssm-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.invoke(AWSSimpleSystemsManagementClient.java:8084) ~[aws-java-sdk-ssm-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.executeGetParametersByPath(AWSSimpleSystemsManagementClient.java:5021) ~[aws-java-sdk-ssm-1.11.415.jar:na]
    at com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagementClient.getParametersByPath(AWSSimpleSystemsManagementClient.java:4992) ~[aws-java-sdk-ssm-1.11.415.jar:na]

我需要在 Java 代码中进行哪些更改才能访问存储在 YYYYYYY 而不是 XXXXXXXXX 中的参数？

【参考方案1】：

在这里找到答案aws-cli-role-assumption-profiles-are-incompatible-with-sdk

显然，这已在 AWS Java SDK 2.x 中得到修复。

【讨论】：

感谢您发布答案！