配置IAM权限后调用StartExportTask仍遇访问拒绝及资源权限疑问

我正在编写脚本创建RDS快照并通过StartExportTask将其导出到S3。已经配置了IAM权限（含截图中权限）、S3的PutObject权限以及MFA凭证，但执行时仍抛出访问拒绝错误。

脚本代码 #

import boto3
import datetime

# Set up client for RDS 
rds = boto3.client('rds')
# Set up client for S3 
s3 = boto3.client('s3') 

# Set the name of the specific database
db_name = "test-db-rds"
# Set the name of the S3 bucket 
s3_bucket = "s3-dev-rds-export"
# Set the prefix for the exported snapshot in S3 
s3_prefix = "snapshots/"

# Set the IAM role ARN for the export task
# role_arn = "arn:aws:iam::1234567890:role/rds-s3-export" 
# Set the KMS key ID for the export task
# kms_key = "arn:aws:kms:us-east-1:1234567890:key/12345678-1234-1234-1234-1234567890"

# Get the current date and time 
now = datetime.datetime.now()
# Construct the snapshot name
RDS_s3_snapshot = db_name + "-" + now.strftime("%Y-%m-%d-%H-%M-%S")

# Create a snapshot of the specific database 
snapshot = rds.create_db_snapshot(DBSnapshotIdentifier=RDS_s3_snapshot, DBInstanceIdentifier=db_name)
# Get the ARN of the snapshot
snapshot_arn = snapshot['DBSnapshot']['DBSnapshotArn']

# Export the snapshot to S3
rds.start_export_task(ExportTaskIdentifier=RDS_s3_snapshot, S3BucketName=s3_bucket, SourceArn=snapshot_arn, IamRoleArn='', S3Prefix=s3_prefix, ExportOnly=db_name)

一、访问拒绝错误的排查点 #

• 必填IAM角色未配置：脚本中start_export_task的IamRoleArn参数传了空字符串，这是导出任务的必填项，需取消注释并填入正确的角色ARN。同时确保该角色具备以下权限：
  • rds:StartExportTask操作权限
  • 目标S3桶的PutObject、AbortMultipartUpload等写入权限
  • 若使用KMS加密，需具备kms:GenerateDataKey、kms:Decrypt权限
• 快照未就绪就导出：创建快照后需要等待其状态变为available才能发起导出，可添加等待逻辑：

  waiter = rds.get_waiter('db_snapshot_completed')
  waiter.wait(DBSnapshotIdentifier=RDS_s3_snapshot)
  

• S3桶权限缺失：除IAM角色权限外，S3桶的桶策略需允许RDS服务主体写入，示例策略：

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {"Service": "rds.amazonaws.com"},
        "Action": ["s3:PutObject", "s3:AbortMultipartUpload"],
        "Resource": "arn:aws:s3:::s3-dev-rds-export/*"
      }
    ]
  }
  

• MFA会话未正确配置：若启用MFA，需通过STS获取带MFA的会话令牌，再初始化RDS客户端：

  sts = boto3.client('sts')
  mfa_response = sts.get_session_token(
      SerialNumber='arn:aws:iam::1234567890:mfa/your-device-id',
      TokenCode='123456'
  )
  rds = boto3.client('rds',
                      aws_access_key_id=mfa_response['Credentials']['AccessKeyId'],
                      aws_secret_access_key=mfa_response['Credentials']['SecretAccessKey'],
                      aws_session_token=mfa_response['Credentials']['SessionToken'])
  

二、StartExportTask能否指定特定快照资源 #

完全可以指定特定快照，无需使用snapshot:*这种宽泛权限。在IAM策略中，可通过快照ARN精准授权：

• 匹配特定前缀的快照（比如脚本生成的命名格式）：

  {
    "Effect": "Allow",
    "Action": "rds:StartExportTask",
    "Resource": "arn:aws:rds:us-east-1:1234567890:snapshot:test-db-rds-*"
  }
  

• 授权单个具体快照：

  {
    "Effect": "Allow",
    "Action": "rds:StartExportTask",
    "Resource": "arn:aws:rds:us-east-1:1234567890:snapshot:test-db-rds-2024-05-20-10-30-00"
  }
  

这种精准授权能有效缩小权限范围，提升安全性。

内容的提问来源于stack exchange，提问作者Ramya Mahe