小编Pra*_*kka的帖子

我创建了一个 IAM 角色“test”并分配给一个 EC2 实例。我创建了一个带有存储桶策略的 S3 存储桶

{
    "Version": "2012-10-17",
    "Id": "Policy1475837721706",
    "Statement": [
        {
            "Sid": "Stmt1475837720370",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::770370070203:role/test"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::test-role-123/*"
        }
    ]
}

从 EC2 中，我通过向以下地址发送curl 请求从这篇AWS 文章中获取了 AccessKey 和 SecretKey

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>

使用上面的响应，我编写了一个节点脚本来向存储桶中的资源发出请求

var AWS = require('aws-sdk');

var d = {
    "Code" : "Success",
    "LastUpdated" : "2016-10-07T12:28:09Z",
    "Type" : "AWS-HMAC",
    "AccessKeyId" : "ASIAIMJBHYLH6GWOWNMQ",
    "SecretAccessKey" : "7V/k5nvFdhXOcT+nhYjGqHM4QmUWjNBUM1ERJQJs",
    "Token" : "FQoDYXdzEO7//////////wEaDGG+SgxD4Es4Z1RBZCKzAz855JuKfm8s7LDcP5T9TGvDdJELsYTzPi47HJ9Q5oaK8OTb0Us0RjvpGW278Mb1gg1dNip1VD2N/GW5/1TFC6xhNpnnZ9+LNkJAwVVZg5raGM91k56X/VOA++/5WivSpO4jWg8fZDibivVyHuoMJJTkurFtEXrweDOCqpiabypTCc5jFtX8NfQuHubwl4C1jp2pMasVS1jwhjU72TA8Pn9EsIIvh8JXDC1dVfppwnslolAeJyOOAHdL1AQSs3nI6IvPCtKhBjtDaVuoiH/lHrnKrw6AeMHoTYQay4wOYRnE4ffngtksekZEULXvERWE4NCs3leXGMqrdzOr8xdZ9m0j3IkshqSS56fkq6E9JtLhSVGyy44ELrL7kYW/dpHE03V+dwQPXMhRafjsVsPD7sUnBfH/+4yyL0VDX1vlFRKbRi50i/Eqvxsb9bcSTsE0W5yWmOWR8reTTYWcWyQXGvxKVYVxLWZKVRfmNfx6IX2sqan7e7pjCtUrqXB1TBMpXdy8KSH9qoJtNAQTYBXws7oFLYY+F2esnNCma0bdNcCeAQ6t/6aPfUdpdLgv8BcGciZxayiqqd6/BQ==",
    "Expiration" : "2016-10-07T18:51:57Z"
};
AWS.config.accessKeyId = d.AccessKeyId;
AWS.config.secretAccessKey = d.SecretAccessKey; …