KMS加密后无法从S3下载文件

Question

使用terraform我能够创建S3桶与KMS加密启用。但是，当我试图从启用S3 KMS的bucket下载任何文件时，它都无法下载，因为访问被拒绝

download failed: s3://services-1234567890-cicd-storage/jars/jdbc-0.211.jar to utilities/jdbc-0.211.jar An error occurred (AccessDenied) when calling the GetObject operation: Access Denied

resource "aws_s3_bucket" "s3_bucket_two" {
  bucket = "dev-analytics-data"
#  bucket = "services-${lookup(var.aws_account_id, terraform.workspace)}-cicd-storage"
  acl    = "${var.acl}"
  versioning {
    enabled = "${var.enable_versioning}"
  }
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = "${data.terraform_remote_state.kms_s3.key_arn}"
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::12345678910:role/iam_role_devops_engineer",
                    "arn:aws:iam:: 12345678910:role/EMR_AutoScaling_DefaultRole",
                    "arn:aws:iam:: 12345678910:role/EMR_DefaultRole",
                    "arn:aws:iam:: 12345678910:user/iam_user_cng_jenkins",
                    "arn:aws:iam:: 12345678910:role/iam_role_sftp",
                    "arn:aws:iam:: 12345678910:role/iam_role_jenkins_user",
                    "arn:aws:iam:: 12345678910:role/EMR_EC2_DefaultRole"
                ]
            },
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::services-12345678910-cicd-storage",
                "arn:aws:s3:::services-12345678910-cicd-storage/*"
            ]
        }
    ]
}

我也尝试通过aws cli上传，但仍然失败。

AWS s3 CP--SSE AWS:KMS--SSE-KMS-Key-ID ARN:AWS:KMS:EU-Central-1:1234567890:KEY/123ASDPS-AS34-AS23-ASAS-ASLKUI98393 SPARK-SQL-KINESIS2.11-2.3.1.JAR s3://Services-1234567890-CICD-Storage/tesie_jars/

Answer 1

您需要授权访问IAM策略中的KMS密钥。

我不能百分之百确定您需要哪些权限，但从这些权限开始（我碰巧知道这组可以工作，因为我从一个工作策略中复制了它，但它可能包括不需要的权限）：

{
    "Effect": "Allow",
    "Action": [
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:GetKeyPolicy",
        "kms:ListGrants",
        "kms:ListKeyPolicies",
        "kms:ListRetirableGrants",
        "kms:ReEncryptFrom",
        "kms:ReEncryptTo"
    ],
    "Resource": "arn:aws:kms:REDACTED:REDACTED:key/REDACTED"
},
{
    "Effect": "Allow",
    "Action": [
        "kms:GenerateRandom",
        "kms:ListAliases",
        "kms:ListKeys"
    ],
    "Resource": "*"
}