AWS Glue跨账号访问S3触发HeadObject 403 Forbidden错误求助

问题场景 #

在AWS账号A的Glue作业中，使用Boto3访问账号B的S3存储桶文件时触发403 Forbidden错误，本地用账号B凭证可正常访问，已配置相关IAM和桶策略但问题依旧。

Glue作业执行的代码：

bucket = 'bucket-name'
filename = 's3-file-name.rdb'
local_filename = 'temp.rdb'

s3 = boto3.client('s3')

s3.download_file(bucket, filename, local_filename) # 错误信息中显示的第127行

触发的错误信息：

File "/tmp/myScript.py", line 127, in <module>
    s3.download_file(bucket, filename, local_filename)
  File "/home/spark/.local/lib/python3.10/site-packages/boto3/s3/inject.py", line 190, in download_file
    return transfer.download_file(
  File "/home/spark/.local/lib/python3.10/site-packages/boto3/s3/transfer.py", line 320, in download_file
    future.result()
  File "/home/spark/.local/lib/python3.10/site-packages/s3transfer/futures.py", line 103, in result
    return self._coordinator.result()
  File "/home/spark/.local/lib/python3.10/site-packages/s3transfer/futures.py", line 266, in result
    raise self._exception
  File "/home/spark/.local/lib/python3.10/site-packages/s3transfer/tasks.py", line 269, in _main
    self._submit(transfer_future=transfer_future, **kwargs)
  File "/home/spark/.local/lib/python3.10/site-packages/s3transfer/download.py", line 354, in _submit
    response = client.head_object(
  File "/home/spark/.local/lib/python3.10/site-packages/botocore/client.py", line 508, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/home/spark/.local/lib/python3.10/site-packages/botocore/client.py", line 915, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden

已配置的权限 #

账号B的S3存储桶策略 #

{
    "Sid": "ReadOnlyFromAccountA",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_A_ID:root"
    },
    "Action": [
      "s3:List*",
      "s3:Get*"
    ],
    "Resource": [
      "arn:aws:s3:::required-bucket",
      "arn:aws:s3:::required-bucket/*"
    ]
}

Glue作业绑定的IAM角色策略 #

{
    "PolicyVersion": {
        "Document": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": [
                        "*",
                        "glue:*"
                    ],
                    "Effect": "Allow",
                    "Resource": "*"
                },
                {
                    "Action": [
                        "s3:DeleteObject",
                        "s3:DeleteBucket",
                        "s3:DeleteBucketPolicy",
                        "iam:DeleteUser",
                        "organizations:*"
                    ],
                    "Effect": "Deny",
                    "Resource": "*"
                }
            ]
        },
        "VersionId": "v3",
        "IsDefaultVersion": true,
        "CreateDate": "2023-09-15T12:16:58Z"
    }
}

本地测试情况 #

使用账号B的本地凭证可正常下载文件，代码如下：

bucket = 'bucket-name'
filename = 's3-file-name.rdb'
local_filename = 'temp.rdb'

session = boto3.Session(profile_name='AWS_ACCOUNT_B')
s3 = session.client('s3')

s3.download_file(bucket, filename, local_filename)

排查方向建议 #

• 检查Glue角色的信任关系：确认信任策略中包含glue.amazonaws.com作为Principal，允许Glue服务扮演该角色。
• 验证桶策略Principal准确性：确认桶策略中的ACCOUNT_A_ID是账号A的正确ID，无拼写错误。
• 检查S3存储桶ACL：确认账号A的Glue角色或账号A根用户在存储桶ACL中拥有读取权限。
• 排查S3公共访问设置：如果存储桶开启了阻止公共访问，需确认配置是否允许跨账号请求。
• STS权限模拟测试：在账号A中用Glue角色凭证调用sts:GetCallerIdentity确认当前身份，再通过iam:SimulatePrincipalPolicy模拟访问账号B桶的权限，排查是否存在隐式拒绝。
• 检查Glue网络配置：若Glue作业使用VPC，确认S3端点（Gateway/Interface）配置正确，路由表、安全组规则允许流量访问目标桶。
• 确认Boto3客户端凭证：在Glue作业中添加代码打印sts:GetCallerIdentity结果，验证当前使用的是账号A的Glue角色凭证。

内容的提问来源于stack exchange，提问作者iAmAwfulAtProgramming