Amazon Kinesis Data应用报cloudwatch:PutMetricData权限错误

问题 #

我运行着一个基于Apache Flink 1.13的AWS Kinesis数据应用，已为关联的IAM角色配置了如下权限策略，并在AWS控制台确认该策略已绑定。

Kinesis应用的AWS角色（Terraform代码） #

resource "aws_iam_role" "kinesis_application_role" {
  name = "dev-kinesis_application_role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          "Service" : "kinesisanalytics.amazonaws.com"
        }
      },
    ]
  })

配置的CloudWatch权限策略 #

{
 "Action": [
   "cloudwatch:PutMetricData"
 ],
 "Effect": "Allow",
 "Resource": [
     "arn:aws:cloudwatch:us-east-1:<aws_account_id>:namespace/*",
     "arn:aws:cloudwatch:us-east-1:<aws_account_id>:metric-stream/*", 
     "arn:aws:cloudwatch:us-east-1:<aws_account_id>:alarm:*",
     "arn:aws:cloudwatch:us-east-1:<aws_account_id>:insight-rule/*",
     "arn:aws:cloudwatch:us-east-1:<aws_account_id>:dashboard/*"
],
 "Sid": "Cloudwatch"
}

错误日志 #

{
"message": "[2023-04-05 20:17:23.165505] [0x000002d4]
[0x00007fa9e42f7700] [error] [metrics_manager.cc:155]
Metrics upload failed. | Code: AccessDenied | Message:
User: arn:aws:sts::008819713222:assumed-role/dev-
kinesis_application_role/kiam-kiam is not authorized to perform:
cloudwatch:PutMetricData because no identity-based policy allows
the cloudwatch:PutMetricData action with address : 52.46.143.92 |
Request was: Action=PutMetricData&Namespace=KinesisProducerLibrary&
MetricData.member.1.MetricName=UserRecordsPending&
MetricData.member.1.Timestamp=2023-04-05T20%3A06%3A54Z&
MetricData.member.1.StatisticValues.SampleCount=299&
MetricData.member.1.StatisticValues.Sum=0&
MetricData.member.1.StatisticValues.Minimum=0&
MetricData.member.1.StatisticValues.Maximum=0&
MetricData.member.1.Unit=Count&MetricData.member.2.MetricName=UserRecordsPending&
MetricData.member.2.Dimensions.member.1.Name=StreamName&
MetricData.member.2.Dimensions.member.1.Value=Events-Dev&
MetricData.member.2.Timestamp=2023-04-05T20%3A06%3A54Z&
MetricData.member.2.StatisticValues.SampleCount=299&
MetricData.member.2.StatisticValues.Sum=0&
MetricData.member.2.StatisticValues.Minimum=0&
MetricData.member.2.StatisticValues.Maximum=0&
MetricData.member.2.Unit=Count&Version=2010-08-01",
"messageSchemaVersion": "1",
"messageType": "ERROR",
"threadName": "kpl-daemon-0003"
}

警告信息 #

[2023-04-05 17:51:13.897017] [0x000002d4][0x00007fa9e10f2700] [warning] AWS Log: WARN
Encountered AWSError 'AccessDenied': User: arn:aws:sts::008819713222:assumed-role/dev-kinesis_application_role/kiam-kiam
is not authorized to perform: cloudwatch:PutMetricData
because no identity-based policy allows the
cloudwatch:PutMetricData action

请问该操作还需要哪些额外权限？

解答 #

问题出在CloudWatch权限策略的Resource配置错误，而非缺少额外权限。

核心原因 #

cloudwatch:PutMetricData操作的资源权限模型特殊：

• 该操作不支持对metric-stream、alarm、dashboard等资源类型授权，策略里包含这些无关资源不会生效，反而可能干扰权限匹配。
• 虽然可以针对特定命名空间授权（格式为arn:aws:cloudwatch:<region>:<account-id>:namespace/<namespace-name>），但当前策略中的namespace/*写法无法匹配Kinesis Producer Library发送指标的请求，或者服务调用时未指定具体的命名空间资源ARN，导致权限不匹配。

修正方案 #

将CloudWatch权限策略的Resource改为*，确保覆盖所有PutMetricData操作场景：

{
  "Action": [
    "cloudwatch:PutMetricData"
  ],
  "Effect": "Allow",
  "Resource": "*",
  "Sid": "Cloudwatch"
}

如果遵循最小权限原则，可针对日志中出现的KinesisProducerLibrary命名空间精准授权：

{
  "Action": [
    "cloudwatch:PutMetricData"
  ],
  "Effect": "Allow",
  "Resource": "arn:aws:cloudwatch:us-east-1:<aws_account_id>:namespace/KinesisProducerLibrary",
  "Sid": "Cloudwatch"
}

额外检查点 #

• 确认Kiam代理（错误日志中显示的kiam-kiam）正确传递了dev-kinesis_application_role的权限，没有对该角色的权限做额外限制。
• 确保策略已正确关联到目标IAM角色，且没有其他拒绝策略（Deny）影响权限生效。

内容的提问来源于stack exchange，提问作者Shankar