AWS SDK for PHP:从实例配置文件元数据服务器检索凭据时出错

Question

我试图通过web api将SNS messeges发送到android.从http://aws.amazon.com/developers/getting-started/php/下载并安装了SDK

运行sample.php时出现以下错误:

Fatal error: Uncaught exception 'Aws\Common\Exception\InstanceProfileCredentialsException' with message 'Error retrieving credentials from the instance profile metadata server. When you are not running inside of Amazon EC2, you must provide your AWS access key ID and secret access key in the "key" and "secret" options when creating a client or provide an instantiated Aws\Common\Credentials\CredentialsInterface object. ([curl] 28: Connection timed out after 5016 milliseconds [url] http://169.254.169.254/latest/meta-data/iam/security-credentials/)' in C:\xampp\htdocs\aws-php\vendor\aws\aws-sdk-php\src\Aws\Common\InstanceMetadata\InstanceMetadataClient.php:85 Stack trace: #0 C:\xampp\htdocs\aws-php\vendor\aws\aws-sdk-php\src\Aws\Common\Credentials\RefreshableInstanceProfileCredentials.php(52): Aws\Common\InstanceMetadata\InstanceMetadataClient->getInstanceProfileCredentials() #1 C:\xampp\htdocs\aws-php\vendor\aws\aws-sdk-php\src\Aws\Common\Credentials\AbstractRefreshableCredentials.php(54): Aws\Common\Credentials\Refreshable in C:\xampp\htdocs\aws-php\vendor\aws\aws-sdk-php\src\Aws\Common\InstanceMetadata\InstanceMetadataClient.php on line 85

关于这个主题的一点指导将对我有所帮助

Answer 1

就我而言,我正在使用

return DynamoDbClient::factory(array(
  'version' => 'latest',
  'region'  => AWS_REGION,
  'key' => AWS_KEY,
  'secret'  => AWS_SECRET
));

曾经没有aws/aws-sdk-php版本2.8.5,但当作曲家自动安装版本3.2.0时,我得到上面的错误.问题很简单,我应该改变我打电话的方式

return DynamoDbClient::factory(array(
  'version' => 'latest',
  'region'  => AWS_REGION,
  'credentials' => array(
    'key' => AWS_KEY,
    'secret'  => AWS_SECRET,
  )
));

如此处所述.在不改变调用的情况下,apache php回退到~/.aws/credentials使用HOME环境变量寻找文件,该变量是空的.您可以通过运行来检查其值php -r 'var_dump(getenv("HOME"));'.

这是一篇相关的帖子

Answer 2

在我的情况下,我不得不使用硬编码凭据

$s3Client = new S3Client([
    'region' => REGION,
    'version' => '2006-03-01',
    'credentials' => [
        'key'    => S3_KEY,
        'secret' => S3_SECRETE,
    ],
]);

在这里查看更多详情:

Answer 3

您必须将.aws/credentials带有配置的文件放在Web服务的主目录中*通常/var/www)不在登录用户的主目录中.

您可以通过echo getenv('HOME');在服务器上的php文件中运行来查找Web服务正在使用的主目录.

Answer 4

I was trying to use a credentials file and got the same error, this guy on github pretty much nailed it:

The credentials file should be in ini format but not have a .ini extension. It should have a 'default' section defined with your key and secret:

$ less ~/.aws/credentials

[default]
aws_access_key_id = key
aws_secret_access_key = secret

If you specified other section name instead of default, just add a profile key to the S3Client parameters:

[example]
aws_access_key_id = key
aws_secret_access_key = secret

$s3Client = new \Aws\S3\S3Client([
    'version' => '2006-03-01',
    'region' => $yourPreferredRegion,
    'profile' => 'example',
]);

Using a credentials file or environment variables is the recommended way of providing credentials on your own server

And @Anti 's answer also helped me alot!

If you prefer the hard coded way, just follow @shadi 's answer.

Answer 5

如果是 laravel 和 aws/aws-sdk-php-laravel sdk，那么在配置所有步骤并在 .env 文件中定义密钥后，您必须删除配置缓存并通过以下命令重建它。

php artisan config:cache;
composer dump-autoload;

Answer 6

假设服务器位于 AWS EC2 上（对于 ECS 和 elastic beanstalk 可能相同），处理此问题的“正确”方法是根本不存储凭证。

相反，这样做：

1. 创建 IAM 角色 ( https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html )
2. 在角色策略中添加相关权限（本例为发送SNS消息）
3. 将角色分配给 EC2 实例（实例设置 => 附加/替换 IAM 角色）

这样您就不会在代码中留下任何敏感数据。