如何通过 @aws-sdk/client-redshift-data 访问 Amazon Redshift

Question

我开发了后端数据库为 Redshift 的示例应用程序，并尝试通过以下 SDK 代码执行查询。

import { RedshiftDataClient, ExecuteStatementCommand } from '@aws-sdk/client-redshift-data';


export const resolvers: IResolvers<unknown, Context> = {
  Query: {
    user: (parent, args, context): User => ({ login: context.login }),
    region: (): string => getRegion(),
    getData: async () => {
      const redshift_client = new RedshiftDataClient({});
      
      const request = new ExecuteStatementCommand({
        ClusterIdentifier: 'testrs',
        Sql: `select * from test`,
        SecretArn: 'arn:aws:secretsmanager:us-east-1:12345561:secret:test-HYRSWs',
        Database: 'test',
      });

      try {
        const data = await redshift_client.send(request);
        console.log('data', data);
        return data;
      } catch (error) {
        console.error(error);
        throw new Error('Failed fetching data to Redshift');
      } finally {
        // execute regardless of error state
      }
    },
  },
};

它返回以下错误

ERROR   AccessDeniedException: 
User: arn:aws:sts::12345561:assumed-role/WebsiteStack-Beta-US-EAST-GraphQLLambdaServiceRole1BCPB5P3Q4IS9/GraphQLLambda 
is not authorized to perform: redshift-data:ExecuteStatement on resource: arn:aws:redshift:us-east-1:12345561:cluster:testrs 
because no identity-based policy allows the redshift-data:ExecuteStatement action

我必须使用 sdk 包吗STS？

如果有人有意见或材料。请告诉我好吗 谢谢

Answer 1

我知道，当针对完全相同的用例使用 AWS SDK for Java V2 时，您可以通过设置ExecuteStatementRequest对象并将其传递到数据客户端的executeStatement 来成功查询数据，如下所示：

if (num ==5)
       sqlStatement = "SELECT TOP 5 * FROM blog ORDER BY date DESC";
 else if (num ==10)
       sqlStatement = "SELECT TOP 10 * FROM blog ORDER BY date DESC";
  else
       sqlStatement = "SELECT * FROM blog ORDER BY date DESC" ;

   ExecuteStatementRequest statementRequest = ExecuteStatementRequest.builder()
                .clusterIdentifier(clusterId)
                .database(database)
                .dbUser(dbUser)
                .sql(sqlStatement)
                .build();

   ExecuteStatementResponse response = redshiftDataClient.executeStatement(statementRequest);

如此处所示 - 所需值为clusterId、database和dbUser。

我认为适用于 JavaScript 的 AWS 开发工具包也会以同样的方式工作。（但是我还没有尝试使用该 SDK）。

参考文档证实了这一点......

临时凭据- 连接到集群时，指定集群标识符、数据库名称和数据库用户名。此外，还需要调用 redshift:GetClusterCredentials 操作的权限。连接到无服务器端点时，指定数据库名称。

https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-redshift-data/classes/executestatementcommand.html