实例角色已配置权限，为何无法从ECS访问AWS Secrets Manager？

我有一个指向正在运行的镜像的ECS任务定义，该任务定义的Task Execution角色包含以下权限：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecretVersionIds"
            ],
            "Resource": "arn:aws:secretsmanager:us-east-2:...:secret:dev/CBusHA/Backend-qoy4yx"
        }
    ]
}

但当我在实例中运行以下Java代码时：

public String getSecret(String secretName){
    SecretsManagerClient secretsManager = SecretsManagerClient.builder()
            .region(Region.US_WEST_2) // Change to your desired region
            .build();

    GetSecretValueRequest getSecretValueRequest = GetSecretValueRequest.builder()
            .secretId(secretName)
            .build();

    GetSecretValueResponse getSecretValueResponse = secretsManager.getSecretValue(getSecretValueRequest);

    secretsManager.close();

    return getSecretValueResponse.secretString();
}

出现以下错误：

software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(), EnvironmentVariableCredentialsProvider(), WebIdentityTokenCredentialsProvider(), ProfileCredentialsProvider(profileName=default, profileFile=ProfileFile(profilesAndSectionsMap=[])), ContainerCredentialsProvider(), InstanceProfileCredentialsProvider()]) : [SystemPropertyCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., WebIdentityTokenCredentialsProvider(): Either the environment variable AWS_WEB_IDENTITY_TOKEN_FILE or the javaproperty aws.webIdentityTokenFile must be set., ProfileCredentialsProvider(profileName=default, profileFile=ProfileFile(profilesAndSectionsMap=[])): Profile file contained no credentials for profile 'default': ProfileFile(profilesAndSectionsMap=[]), ContainerCredentialsProvider(): Cannot fetch credentials from container - neither AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables are set., InstanceProfileCredentialsProvider(): Failed to load credentials from IMDS.]

我已确保Secrets Manager配置了以下资源权限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::...:role/ecsTaskExecutionRole"
      },
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "*"
    }
  ]
}

我遗漏了什么？该如何添加权限以允许从ECS访问SecretsManager？

1. 修正ECS任务的IAM角色配置 #

错误核心是凭证加载失败，而非权限不足：

• 区分Task Execution Role和Task Role：Execution Role用于拉取镜像、推送日志等基础操作；应用代码访问Secrets Manager需要用Task Role，需在任务定义中配置taskRoleArn字段，并给该角色添加对应的Secrets Manager权限。
• 确保任务定义的executionRoleArn和taskRoleArn都指向正确的IAM角色，且角色已生效。

2. 统一区域配置 #

你的Secrets Manager资源在us-east-2区域，但代码中指定的是US_WEST_2，区域不一致会导致请求失效。将代码中的区域修改为Region.US_EAST_2，或者确保Secrets Manager与代码使用同一区域。

3. 检查网络与元数据访问权限 #

• 若为EC2类型ECS任务：确保EC2实例的IAM角色允许访问实例元数据服务（IMDS），EC2上的ECS任务通过IMDS获取凭证；同时检查安全组允许出站访问Secrets Manager的443端口。
• 若为Fargate类型ECS任务：如果任务部署在私有子网，需配置NAT网关确保能访问AWS公共服务；安全组同样要允许443端口出站。

4. 验证IAM角色的信任关系 #

检查Task Role或Execution Role的信任策略，确保允许ECS服务承担该角色：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

5. 保持代码默认凭证链 #

AWS SDK for Java会自动从ECS任务环境中加载凭证，你的当前代码无需手动指定凭证提供器，只要环境配置正确即可自动获取权限。

内容的提问来源于stack exchange，提问作者Jackie