AWS秘密管理器访问拒绝问题

Question

我在帐户a中存储了一个密钥(USRFTP)，我想从EC2框中使用帐户B中的角色ASHISHROLE访问这个密钥。我正在运行python代码来获取密钥，如下所示，在密钥中使用资源策略，KMS策略如下所示，但仍然得到这个问题

clienterRor:调用GetSecretValue操作时发生错误（AccessDeniedException）：User：ARN：AWS：STS：：AccountB：假定-Role/AshishRole/I-***********无权在资源上执行：SecretsManager：GetSecretValue：ARN：AWS：SecretsManager:US-EAST-2:Accounta:Secret:USRFTP-KJHJH

    import boto3
    import base64
    from botocore.exceptions import ClientError
    def get_secret():
        secret_name = "arn:aws:secretsmanager:us-east-2:ACCOUNTA:secret:USRFTP"
        region_name = "us-east-2"
        # Create a Secrets Manager client
        session = boto3.session.Session()
        client = session.client(
            service_name='secretsmanager',
            region_name=region_name
        )
        print("here")

        get_secret_value_response = client.get_secret_value(
            SecretId=secret_name
        )
        if 'SecretString' in get_secret_value_response:
            return  get_secret_value_response['SecretString']
        else:
            return  base64.b64decode(get_secret_value_response['SecretBinary'])
    
    print(get_secret())

SECRET KEY RESOURCE POLICY
  

 {
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Effect" : "Allow",
    "Principal" : {
      "AWS" : "arn:aws:iam::ACCOUNTB:role/ASHISHROLE"
    },
    "Action" : "secretsmanager:GetSecretValue",
    "Resource" : "*"
  } ]
}

KMS POLICY

    {
        "Id": "key-consolepolicy-3",
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "Enable IAM User Permissions",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::ACCOUNTA:root"
                },
                "Action": "kms:*",
                "Resource": "*"
            },
            {
                "Sid": "Allow access for Key Administrators",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::ACCOUNTA:role/OKin"
                },
                "Action": [
                    "kms:Create*",
                    "kms:Describe*",
                    "kms:Enable*",
                    "kms:List*",
                    "kms:Put*",
                    "kms:Update*",
                    "kms:Revoke*",
                    "kms:Disable*",
                    "kms:Get*",
                    "kms:Delete*",
                    "kms:TagResource",
                    "kms:UntagResource",
                    "kms:ScheduleKeyDeletion",
                    "kms:CancelKeyDeletion"
                ],
                "Resource": "*"
            },
            {
                "Sid": "Allow use of the key",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::ACCOUNTB:root"
                },
                "Action": [
                    "kms:Encrypt",
                    "kms:Decrypt",
                    "kms:ReEncrypt*",
                    "kms:GenerateDataKey*",
                    "kms:DescribeKey"
                ],
                "Resource": "*"
            },
            {
                "Sid": "Allow attachment of persistent resources",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::ACCOUNTB:root"
                },
                "Action": [
                    "kms:CreateGrant",
                    "kms:ListGrants",
                    "kms:RevokeGrant"
                ],
                "Resource": "*",
                "Condition": {
                    "Bool": {
                        "kms:GrantIsForAWSResource": "true"
                    }
                }
            }
        ]
    }

Answer 1

跨帐户权限最困难的概念是，它需要从两个方向授予权限。

在您的情况下，您有：

• 帐户中的机密管理器-a
• 帐户中的EC2实例-b
• 帐户-b
中的IAM角色( 角色-b)

null

null

• 默认情况下，IAM用户/IAM角色没有权限
• 要使用机密管理器（即使在同一个帐户中），必须向IAM角色授予权限，例如secretsmanager:getsecretvalue--否则不允许它执行任何操作
• 默认情况下，一个AWS帐户不能从另一个AWS帐户访问（例如我不能访问您的帐户）
• 如果一个AWS帐户愿意让另一个帐户访问它，那么它必须授予访问权限。这可以在S3、SNS、SQS、KMS和Secrets Manager等服务的资源级别上完成，因为它们能够创建关于资源的策略。没有此功能的服务不能授予跨帐户访问权限，必须通过在同一帐户中扮演角色来使用。

您的问题中的配置似乎缺少需要授予角色-b访问机密管理器的权限，例如：

json prettyprint-override">{
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect": "Allow",
          "Action": "secretsmanager:GetSecretValue",
          "Resource": "arn:aws:secretsmanager:us-east-2:ACCOUNTA:secret:USRFTP"
        }
      ]
}