AWS Secrets Manager：GetSecretValue正常但BatchGetSecretValue权限被拒

我配置了AWS IAM策略，允许对指定资源的SecretsManager进行全量访问：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "secretsmanager:*"
            ],
            "Resource": [
                "arn:aws:secretsmanager:us-east-2:MYACCOUNTID:secret:*"
            ],
            "Effect": "Allow"
        }
    ]
}

运行AWS CLI命令get-secret-value可正常执行，但batch-get-secret-value返回权限拒绝错误：

An error occurred (AccessDeniedException) when calling the BatchGetSecretValue operation:
 User: arn:aws:sts::MYACCOUNTID:assumed-role/my-server-staging-us-east-2/i-XXXXXXXXXXXXXXXXX is not
 authorized to perform: secretsmanager:BatchGetSecretValue because no identity-based policy allows the
 secretsmanager:BatchGetSecretValue action

实际执行情况如下：

ubuntu@vapp-3-145-XX-XXX:~$ /snap/bin/aws --region us-east-2 secretsmanager get-secret-value --secret-id secret-secret-account
{
    "ARN": "arn:aws:secretsmanager:us-east-2:MYACCOUNTID:secret:secret-secret-account-2eHacl",
    "Name": "secret-secret-account",
    "VersionId": "b72697d0-4d9d-4bbe-8504-d174d7444510",
    "SecretString": "FOOBAR",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": "2024-11-12T14:05:56.132000+00:00"
}
ubuntu@vapp-3-145-XX-XXX:~$ /snap/bin/aws --region us-east-2 secretsmanager batch-get-secret-value --secret-id-list secret-secret-account
An error occurred (AccessDeniedException) when calling the BatchGetSecretValue operation: User: arn:aws:sts::MYACCOUNTID:assumed-role/my-server-staging-us-east-2/i-XXXXXXXXXXXXXXXXX is not authorized to perform: secretsmanager:BatchGetSecretValue because no identity-based policy allows the secretsmanager:BatchGetSecretValue action

这是怎么回事？

我在网上搜索到建议在策略中添加Principal元素，但尝试添加时，IAM策略编辑器提示：Unsupported Principal: The policy type IDENTITY_POLICY does not support the Principal element. Remove the Principal element。

更新1

我验证了该实例仅关联了一个包含SecretsManager相关配置的策略，符合预期：

$ (
function aws() { /snap/bin/aws --profile MYPROFILE "$@"; };
iamProfile=$(aws ec2 describe-instances --instance-id i-XXXXXXXXXXXXXXXXX | \
  jq -r '.Reservations[].Instances[].IamInstanceProfile.Arn|split("/")|last');
aws iam get-instance-profile --instance-profile "$iamProfile" | \
  jq -r '.InstanceProfile.Roles[].RoleName' | while read roleName; do
aws iam list-attached-role-policies --role-name vapp-role-staging-us-east-2 | \
  jq -r '.AttachedPolicies[].PolicyArn' | while read policyArn; do
aws iam get-policy --policy-arn "$policyArn" | \
  jq -r '.Policy.DefaultVersionId' | while read defVer; do
aws iam get-policy-version --policy-arn "$policyArn" --version-id "$defVer" | \
  jq -r '.PolicyVersion.Document.Statement[].Action|if type == "array" then . else [.] end|.[]';
done;
done;
done;
)|grep secretsmanager
secretsmanager:*

更新2

我们的组织已启用Service Control Policies（SCP），且仅配置了AWS托管的FullAWSAccess策略，该策略已应用于根账号、所有子账号及所有组织单元。

更新3

我发现增加Resource字段的ARN通配符无效，但将Resource设为["*"]时，EC2实例可成功调用BatchGetSecretValue。

更奇怪的是，使用最初的策略（允许对特定密钥ARN执行secretsmanager:GetSecretValue），再添加一条无资源限制的secretsmanager:BatchGetSecretValue语句：

{"Version": "2012-10-17","Statement": [
  { "Action": [ "secretsmanager:GetSecretValue" ],
    "Resource": [ "arn:aws:secretsmanager:us-east-2:MYACCUOUNTID:secret:secret-secret-account", ... ],
    "Effect": "Allow" },
  { "Action": [ "secretsmanager:BatchGetSecretValue" ],
    "Resource": [ "*" ],
    "Effect": "Allow" }
]}

此时batch-get-secret-value返回异常错误：

{
    "SecretValues": [],
    "Errors": [
        {
            "SecretId": "secret-secret-account",
            "ErrorCode": "AccessDeniedException",
            "Message": "User: arn:aws:sts::MYACCOUNTID:assumed-role/my-server-staging-us-east-2/i-XXXXXXXXXXXXXXXXX is not authorized to perform: secretsmanager:GetSecretValue on resource: secret-secret-account because no identity-based policy allows the secretsmanager:GetSecretValue action"
        }
    ]
}

格式是正确的，但批量API返回的结果中包含请求密钥的权限拒绝错误，而实际上该权限是存在的。更诡异的是，在此配置下，get-secret-value调用偶尔会失败。

目前我的临时解决方案是使用权限过宽的策略语句："Action":["secretsmanager:GetSecretValue","secretsmanager:BatchGetSecretValue"],"Resource":"*","Effect":"Allow"，但这并非合理方案，因为同一区域和账号下运行多个应用，它们不应互相访问彼此的密钥。

更新4

这种不一致的行为似乎是由于请求访问了不同的API服务器，这些服务器更新策略版本的时间不同，有时长达10分钟，但最终会趋于一致。

内容的提问来源于stack exchange，提问作者Guss