小编eet*_*tee的帖子

我一直在尝试设置亚马逊的STS(安全令牌服务)来创建客户端上传到S3的临时凭证.

我可以使用从IAM用户生成的访问密钥使代码正常工作,但是当我交换访问密钥/密钥然后添加会话令牌时,我得到403 Forbidden.S3访问日志不记录尝试.

在STS端,我通过aws-sdk为node.js生成凭证,使用与上面相同的IAM用户,SDK愉快地生成STS凭证:

let sts = new AWS.STS({apiVersion: '2011-06-15'});
sts.assumeRole({
  RoleArn: 'arn:aws:iam::[REMOVED]:role/[REMOVED]',
  RoleSessionName: [REMOVED (generated by concatenating a few ids)]
  DurationSeconds: 60 * 20,
}, (err, data)=>{
  //callback handling
});

上传测试代码:

var AWS = require('aws-sdk');

// Load the stream
var fs = require('fs');
var body = fs.createReadStream('./helloworld.txt');

AWS.config.update({
  region: 'ap-southeast-2',
  accessKeyId: '[REMOVED]',
  secretAccessKey: '[REMOVED]',
  sessionToken: '[REMOVED]'
});

// Upload the stream
var s3 = new AWS.S3();

s3.putObject({
  Body: body,
  Bucket: '[REMOVED]',
  Key: 'helloworld.txt'
}, function(err, data) {
  if (err) …