那些遇到过的问题

IntelliJ：为 gradle 运行配置设置 AWS 环境变量

Tun*_*ick 5 intellij-idea amazon-s3 gradle amazon-web-services amazon-iam

我正在尝试为配置了 gradle 的 Java Spring Boot 设置本地开发环境，它需要一个有效的 AWS CLI 环境。请务必注意，存在不同的配置文件 ( .aws/config)（default未配置），它们是role_arn具有 MFA ( ) 的不同角色开关 ( mfa_serial)。

描述

目前我正在使用 Windows 10 Build 18363（“19.09”）、IntelliJ Ultimate 20.02、gradle 5.6.4。为了运行这个应用程序，我使用 gradleclean bootRun任务和以下环境变量设置了运行配置：

  • AWS_SECRET_ACCESS_KEY
  • AWS_ACCESS_KEY_ID
  • AWS_REGION
  • AWS_DEFAULT_REGION
  • AWS_PROFILE
  • AWS_DEFAULT_PROFILE
#.aws/config
[profile prod]
region=eu-central-1
output=json
role_arn=<role_arn_prod>
source_profile=site-iam
mfa_serial=<arn_iam_user_mfa_1>


[profile sit]
region=eu-central-1
output=json
role_arn=<role_arn_sit>
source_profile=site-iam
mfa_serial=<arn_iam_user_mfa_1>

[profile dev]
region=eu-central-1
output=json
role_arn=<role_arn_dev>
source_profile=site-iam
mfa_serial=<arn_iam_user_mfa_1>

[profile site-iam]
region=eu-central-1
output=json

[default]
Run Code Online (Sandbox Code Playgroud) 
#.aws/credentials
[default]
aws_access_key_id = <access_key_id_1>
aws_secret_access_key = <secret_access_key_1>

[site-iam]
aws_access_key_id = <access_key_id_1>
aws_secret_access_key = <secret_access_key_1>
Run Code Online (Sandbox Code Playgroud)

行为

这个java应用程序内部的请求非常简单。

#.aws/config
[profile prod]
region=eu-central-1
output=json
role_arn=<role_arn_prod>
source_profile=site-iam
mfa_serial=<arn_iam_user_mfa_1>


[profile sit]
region=eu-central-1
output=json
role_arn=<role_arn_sit>
source_profile=site-iam
mfa_serial=<arn_iam_user_mfa_1>

[profile dev]
region=eu-central-1
output=json
role_arn=<role_arn_dev>
source_profile=site-iam
mfa_serial=<arn_iam_user_mfa_1>

[profile site-iam]
region=eu-central-1
output=json

[default]
Run Code Online (Sandbox Code Playgroud)

下面的错误表明没有角色切换和/或身份验证失败（因为我们需要提交 TOTP 才能进行身份验证。

Caused by: software.amazon.awssdk.services.s3.model.S3Exception: Access Denied (Service: S3, Status Code: 403, Request ID: <REQUEST_ID>)
    at software.amazon.awssdk.core.internal.http.CombinedResponseHandler.handleErrorResponse(CombinedResponseHandler.java:123) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.CombinedResponseHandler.handleResponse(CombinedResponseHandler.java:79) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.CombinedResponseHandler.handle(CombinedResponseHandler.java:59) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.CombinedResponseHandler.handle(CombinedResponseHandler.java:40) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.execute(HandleResponseStage.java:40) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.execute(HandleResponseStage.java:30) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:73) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:42) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:77) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:39) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:64) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:34) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:56) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:36) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.executeWithTimer(ApiCallTimeoutTrackingStage.java:80) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:60) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:42) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:37) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:26) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.http.AmazonSyncHttpClient$RequestExecutionBuilderImpl.execute(AmazonSyncHttpClient.java:189) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.invoke(BaseSyncClientHandler.java:121) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.doExecute(BaseSyncClientHandler.java:147) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:76) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:52) ~[sdk-core-2.13.13.jar:na]
    at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:62) ~[aws-core-2.13.13.jar:na]
    at software.amazon.awssdk.services.s3.DefaultS3Client.getObject(DefaultS3Client.java:3606) ~[s3-2.13.13.jar:na]
    at software.amazon.awssdk.services.s3.S3Client.getObjectAsBytes(S3Client.java:7563) ~[s3-2.13.13.jar:na]
Run Code Online (Sandbox Code Playgroud)

类似的行为可以通过 cmd 重现

aws s3 ls

An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied
Run Code Online (Sandbox Code Playgroud)

不同的方法

STS 获取会话令牌 | 环境变量

我已经通过以下方式获得了会话令牌

#.aws/credentials
[default]
aws_access_key_id = <access_key_id_1>
aws_secret_access_key = <secret_access_key_1>

[site-iam]
aws_access_key_id = <access_key_id_1>
aws_secret_access_key = <secret_access_key_1>
Run Code Online (Sandbox Code Playgroud)

作为 json

{
    "Credentials": {
        "AccessKeyId": "<access_key_id_2>",
        "SecretAccessKey": "<secret_access_key_2>",
        "SessionToken": "<session_token_2>",
        "Expiration": "2020-08-02T22:57:12+00:00"
    }
}
Run Code Online (Sandbox Code Playgroud)

并将以下环境变量更新为获得的值：

  • AWS_ACCESS_KEY_ID:<access_key_id_2>
  • AWS_SECRET_ACCESS_KEY:<secret_access_key_2>
  • AWS_SESSION_TOKEN:<session_token_2>
  • AWS_SECURITY_TOKEN:<session_token_2>

但这返回相同的错误

Caused by: software.amazon.awssdk.services.s3.model.S3Exception: Access Denied (Service: S3, Status Code: 403, Request ID: <request_id>)
Run Code Online (Sandbox Code Playgroud)

快速而肮脏的.aws/config修复

经过多次调试后，配置default文件按以下方式更改

[default]
region=eu-central-1
output=json
role_arn=<role_arn_prod>
source_profile=site-iam
mfa_serial=<arn_iam_user_mfa_1>
Run Code Online (Sandbox Code Playgroud)

这导致

Caused by: software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(), EnvironmentVariableCredentialsProvider(), WebIdentityTokenCredentialsProvider(), ProfileCredentialsProvider(), ContainerCredentialsProvider(), InstanceProfileCredentialsProvider()]) : [SystemPropertyCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., WebIdentityTokenCredentialsProvider(): Either the environment variable AWS_WEB_IDENTITY_TOKEN_FILE or the javaproperty aws.webIdentityTokenFile must be set., ProfileCredentialsProvider(): To use assumed roles in the '<ROLE_PROFILE>' profile, the 'sts' service module must be on the class path., ContainerCredentialsProvider(): Cannot fetch credentials from container - neither AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables are set., InstanceProfileCredentialsProvider(): Unable to load credentials from service endpoint.]
Run Code Online (Sandbox Code Playgroud)

环境AWS_WEB_IDENTITY_TOKEN_FILE

环境变量被设置为通过 WSL sytle 路径 ( )AWS_WEB_IDENTITY_TOKEN_FILE位于的现有令牌文件，即使环境变量存在和/或更新，也会导致与上面相同的错误~/.aws/cli/cache\wsl$\...

Caused by: software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(), EnvironmentVariableCredentialsProvider(), WebIdentityTokenCredentialsProvider(), ProfileCredentialsProvider(), ContainerCredentialsProvider(), InstanceProfileCredentialsProvider()]) : [SystemPropertyCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., WebIdentityTokenCredentialsProvider(): Either the environment variable AWS_WEB_IDENTITY_TOKEN_FILE or the javaproperty aws.webIdentityTokenFile must be set., ProfileCredentialsProvider(): To use assumed roles in the '<ROLE_PROFILE>' profile, the 'sts' service module must be on the class path., ContainerCredentialsProvider(): Cannot fetch credentials from container - neither AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables are set., InstanceProfileCredentialsProvider(): Unable to load credentials from service endpoint.]
Run Code Online (Sandbox Code Playgroud)

调试

不存在权限问题。此特定文件的下载适用于正确的角色 arn。


C:\Users\tunnelblick>aws s3 ls

An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied

C:\Users\tunnelblick>aws s3 ls --profile prod
Enter MFA code for <arn_iam_user_mfa_1>:
2020-02-05 09:28:41 <bucket_1>
2020-06-23 05:16:07 <bucket_2>

C:\Users\tunnelblick>aws s3 cp s3://<bucket_1>/<file>.json .
fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

C:\Users\tunnelblick>aws s3 cp s3://<bucket_1>/<file>.json . --profile prod
download: s3://<bucket_1>/<file>.json to .\<file>.json
Run Code Online (Sandbox Code Playgroud)

在我的 WSL 1 终端中设置这些环境变量并执行aws s3 ls会导致相同的Access Denied错误 ( An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied)

Tun*_*ick 1

后来我也尝试在~/.aws/credentials文件中设置这些值。我似乎缺少一些可以使用aws-mfa（AWS STS 的 python 包装器）解决的选项。我正在使用以下示例

aws-mfa --duration 1800 --device arn:aws:iam::123456788990:mfa/dudeman --assume-role arn:aws:iam::123456788990:role/some-role --role-session-name some-role-session`
Run Code Online (Sandbox Code Playgroud)

这会在default配置文件中填充用于正确角色切换的附加选项，例如assumed_role、assume_role_arn、aws_session_token、aws_security_token、 ，expiration并且与我的运行配置一起使用就像一个魅力。

归档时间：

查看次数：

4839 次

最近记录：

5 年，3 月 前
相关归档
IntelliJ组织进口 242
如何调整IntelliJ中行尾的位置 19
如何查看IntelliJ中的所有jslint错误？ 10
如何在Amazon AWS Lambda函数中发布到MQTT主题？ 10
java.lang.NoClassDefFoundError:尝试运行jar时 9
如何修复未解析的引用生命周期范围？ 8
Android Studio 4.1 adb 卡住了 8
如何在IntelliJ中为特定对象实例设置断点条件？ 5
从java 10升级到java 11并将gradle 4.10升级到gradle.5.2:"默认构造函数中未初始化变量" 5
如何解决 IntelliJ 中的“无法将‘字符串’分配给‘发布’”Gradle 错误？ 2
难疑归档
在JavaScript中创建多行字符串 2412
在vi中快速缩进多行 2111
Bower和npm有什么区别？ 1723
Python join:为什么是string.join(list)而不是list.join(string)？ 1669
在JavaScript中将字符串转换为整数？ 1603
如何将堆栈跟踪转换为字符串？ 1435
UNION和UNION ALL有什么区别？ 1350
如何克隆仅Git存储库的子目录？ 1298
application/x-www-form-urlencoded或multipart/form-data？ 1268
Objective-C中的快捷方式用于连接NSStrings 1114