为什么AWS boto3调用associate_iam_instance_profile会导致无效名称的无效名称无效？

Question

我有调用AWS boto3 API的代码。此代码使用iam客户端和ec2客户端执行以下几项操作：

iam_client = boto3.client('iam')
ec2_client = boto3.client('ec2')

对于所有这些调用，角色名和配置文件名都是相同的：MyExampleName

1. 调用iam\U客户端。创建实例配置文件以创建新的实例配置文件

但最后一次呼叫失败，出现如下消息：

INFO”失败：调用AssociateIamInstanceProfile操作时发生错误（InvalidParameterValue）：参数iamInstanceProfile.name的值（MyCanpleName）无效。无效的IAM实例配置文件名，帐户ID： XXXXXXXXXXXXX，资源： EC2实例： i-78sd976sd6912"

我刚刚创建了个人资料，那么为什么打电话给associate_iam_instance_profile说它是无效的呢？

Answer 1

使用IAM客户机和EC2客户机时都有一点时间问题。通过iam\u客户端创建的配置文件可能不会立即被ec2\u客户端使用。通过一些重试逻辑，名称似乎最终会起作用——它并不是真的无效，只是还没有找到：

import time

logger.info('Attaching profile: MyExampleName'))
counter = 0
while counter < 60:
    try:
        ec2_client.associate_iam_instance_profile(IamInstanceProfile={'Name': 'MyExampleName'},
                                                  InstanceId='i-78sd976sd6912')
        break
    except ClientError as err:
        if err.response['Error']['Code'] == 'InvalidParameterValue':
            counter = counter + 1
            logger.info('The ec2 client did not find the profile yet; wait 1 second and then try again')
            time.sleep(1)
logger.info('Finally worked!')

以下日志显示了一个真实世界的日志条目示例，这些日志条目显示EC2客户端最终与IAM客户端一致：

INFO "Attaching profile: MyExampleName"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "The profile is not found yet; wait 1 second and then try again"
INFO "Finally worked!"

Answer 2

更方便的方法是依靠专门构建的服务员等待某些资源可用。

waiter = client.get_waiter('instance_profile_exists')
waiter.wait(
    InstanceProfileName='string',
    WaiterConfig={
        'Delay': 123,
        'MaxAttempts': 123
    }
)

您的方法的问题是，您依赖于资源将在60秒内创建的假设，但情况可能并非总是如此。而服务员则继续轮询，直到资源可用。

阅读更多关于可用服务员的信息https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.get_waiter