调用AWS Entity Resolution API遇权限问题，缺失哪一步？

我正尝试调用AWS Entity Resolution的GetMatchId API，当前配置如下：

IAM用户详情 #

• IAM用户：user1
• 关联策略：AssumeRolePolicy

已为user1生成访问密钥和密钥密码，并在Spring Boot应用中使用。

附加到user1的AssumeRolePolicy策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::004724176825:role/scv-er-poc-er-service-sbox"
        }
    ]
}

角色scv-er-poc-er-service-sbox详情 #

该角色已附加AWSEntityResolutionConsoleFullAccess策略，其信任实体配置如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::004724176825:user/user1",
                "Service": "entityresolution.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

遇到的错误 #

User: arn:aws:iam::004724176825:user/user1 is not authorized to perform: entityresolution:GetMatchId on resource: arn:aws:entityresolution:eu-west.

我的Spring Boot代码 #

@Bean
public EntityResolutionClient entityResolutionClient() {
    AwsCredentials credentials = AwsBasicCredentials.create("<Access key>",
            "<Secret>");
    StaticCredentialsProvider staticProvider = StaticCredentialsProvider.create(credentials);

    Region region = Region.EU_WEST_1;
    EntityResolutionClient entityResolutionClient = EntityResolutionClient.builder()
            .region(region)
            .credentialsProvider(staticProvider)
            .build();
    return entityResolutionClient;
}

请问在这个流程中我缺失了哪一步？

问题根源与解决步骤 #

你当前的代码直接使用user1的访问密钥调用API，但user1本身仅有sts:AssumeRole权限，没有直接调用entityresolution:GetMatchId的权限。必须先通过user1的凭证扮演scv-er-poc-er-service-sbox角色，再用该角色的临时凭证发起API请求。

修改后的Java代码示例：

@Bean
public EntityResolutionClient entityResolutionClient() {
    // 1. 用user1的凭证创建STS客户端
    AwsCredentials userCredentials = AwsBasicCredentials.create("<Access key>", "<Secret>");
    StsClient stsClient = StsClient.builder()
            .region(Region.EU_WEST_1)
            .credentialsProvider(StaticCredentialsProvider.create(userCredentials))
            .build();

    // 2. 调用AssumeRole获取临时凭证
    AssumeRoleRequest assumeRoleRequest = AssumeRoleRequest.builder()
            .roleArn("arn:aws:iam::004724176825:role/scv-er-poc-er-service-sbox")
            .roleSessionName("entity-resolution-session") // 自定义会话名称
            .build();
    AssumeRoleResponse assumeRoleResponse = stsClient.assumeRole(assumeRoleRequest);
    Credentials tempCredentials = assumeRoleResponse.credentials();

    // 3. 用临时凭证创建Entity Resolution客户端
    AwsSessionCredentials sessionCredentials = AwsSessionCredentials.create(
            tempCredentials.accessKeyId(),
            tempCredentials.secretAccessKey(),
            tempCredentials.sessionToken());

    return EntityResolutionClient.builder()
            .region(Region.EU_WEST_1)
            .credentialsProvider(StaticCredentialsProvider.create(sessionCredentials))
            .build();
}

额外注意事项：

• 确认AWSEntityResolutionConsoleFullAccess策略包含entityresolution:GetMatchId权限（可在IAM控制台查看策略详情）。
• 错误信息中的资源ARN不完整（应为eu-west-1加对应资源标识），这是权限不足导致的提示异常，完成凭证扮演后会自动修正。

内容的提问来源于stack exchange，提问作者Sarangan