AWS-无法从EC2访问S3 bucket对象

Question

我不确定我是不是漏了一步。

我有一个s3 bucket，我需要能够从一个AWS SDK PHP脚本访问我写的运行在我的EC2上。我创建了一个IAM角色以允许访问。

IAM Allow_S3_Access_to_EC2

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::myinbox"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::myinbox/*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor3",
            "Effect": "Allow",
            "Action": "s3:DeleteObject",
            "Resource": "arn:aws:s3:::myinbox/*"
        }
    ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSESPuts",
            "Effect": "Allow",
            "Principal": {
                "Service": "ses.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::myinbox/*",
            "Condition": {
                "StringEquals": {
                    "aws:Referer": "************"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::************:role/Allow_S3_Access_to_EC2"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::myinbox",
                "arn:aws:s3:::myinbox/*"
            ]
        }
    ]
}

我的Bucket策略中没有任何关于我的EC2甚至我附加的IAM角色的内容。我也需要在我的桶策略中添加一些东西吗？这就是我困惑的地方。

我所经历的是，当一个新的对象被创建，我试图从我的AWS SDK PHP访问该对象时，我得到了一个“403”禁止。如果我在S3控制台中公开该对象，我就可以很好地访问它。因此，即使我为EC2设置了访问S3的权限，除非我将该对象公开，否则我无法访问它。

我甚至尝试通过终端对实际服务器上的对象使用wget，但除非公开该对象，否则我仍然获得403

require '../aws-ses/aws-autoloader.php';

use Aws\S3\S3Client;
use Aws\S3\Exception\S3Exception;

$bucketName = 'myinbox';

try {
// Instantiate the client.
    $s3 = new S3Client([
        'version' => 'latest',
        'region'  => 'us-west-2',
        'credentials' => array('key'=>'*********************',
                    'secret'=>'*******************************************')
    ]);
} catch (Exception $e) {
    // We use a die, so if this fails. It stops here. Typically this is a REST call so this would
    // return a json object.
    die("Error: " . $e->getMessage());
}
// Use the high-level iterators (returns ALL of your objects).
$objects = $s3->getIterator('ListObjects', array('Bucket' => $bucketName));

Answer 1

首先，您是否设置了信任关系，以便EC2服务能够承担该角色？

接下来，不要将IAM角色与EC2实例直接关联；相反，您需要使用实例配置文件。是否设置了与该角色关联的实例配置文件？

本文档是一个良好的开端：https://docs.aws.amazon.com/codedeploy/latest/userguide/gett-start-create-iam-instance-profile.html