无法从弹性Beanstalk连接到Amazon SimpleDB

Question

我有一个与Amazon SimpleDB通信的应用程序。在localhost上运行时，一切都运行得很好，我在localhost上将这个webapp部署到我的Tomcat实例中。

我在本地Tomcat和部署应用程序的弹性Beanstalk上都将AWS凭据指定为环境变量。

然而，在弹性Beanstalk上，我得到了一个自动异常（它是一个Spring引导应用程序），这是由以下原因引起的：

Caused by: com.amazonaws.AmazonServiceException: User (arn:aws:sts::295923482971:assumed-role/aws-elasticbeanstalk-ec2-role/i-b35eef66) does not have permission to perform (sdb:ListDomains) on resource (arn:aws:sdb:us-east-1:295923482971:domain/). Contact account owner. (Service: AmazonSimpleDB; Status Code: 403; Error Code: AuthorizationFailure; Request ID: a20f4ed9-a54d-ec13-2886-b5d31cce3778)
    at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(AmazonHttpClient.java:1088)
    at com.amazonaws.http.AmazonHttpClient.executeOneRequest(AmazonHttpClient.java:735)
    at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:461)
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:296)
    at com.amazonaws.services.simpledb.AmazonSimpleDBClient.invoke(AmazonSimpleDBClient.java:1021)
    at com.amazonaws.services.simpledb.AmazonSimpleDBClient.listDomains(AmazonSimpleDBClient.java:708)
    at com.amazonaws.services.simpledb.AmazonSimpleDBClient.listDomains(AmazonSimpleDBClient.java:974)
    at com.berrycloud.paypal.service.impl.SimpleDBServiceImpl.init(SimpleDBServiceImpl.java:53)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:497)
    at 

这种情况发生在启动过程中，我将自动生成一个类（以下代码）：

  @PostConstruct
  private void init() {
    log.debug("Setting database client endpoint: {}", endpoint);
    client.setEndpoint(endpoint);

    // check if the domain exists
    log.debug("Listing existing domains...");

    final List<String> tableNames = client.listDomains().getDomainNames();
    if (!tableNames.contains(domain)) {
      // if not, create it
      log.debug("Creating domain {}", domain);
      client.createDomain(new CreateDomainRequest(domain));
    }
  }

我使用了相同的AWS证书，在本地和弹性豆茎，所以我不明白为什么它在第一种情况下工作，但在另一种情况下失败。有人能帮我一下吗？

Answer 1

您对用户有什么策略吗？一般来说，这意味着IAM策略不够好，您可以在这里阅读更多内容

您可以尝试添加：

{
   "Version": "2015-09-14",
   "Statement":[{
      "Effect":"Allow",
      "Action":"sdb:ListDomains",
      "Resource":"arn:aws:sdb:us-east-1:295923482971:domain/<youraccount>"
      }
   ]
}