Travis-CI部署AWS EKS遇AccessDenied：kubectl命令执行失败求助

API 探路者

2026-8-19

问题排查：kubectl apply 执行失败的IAM权限问题

错误信息

"An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::XXXXXXXXXXXXX:user/username is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::XXXXXXXXXXXXX:user/username Unable to connect to the server: getting credentials: exec: executable aws failed with exit code 254"

当前配置的IAM策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": "arn:aws:iam::XXXXXXXXXXXXX:user/username"
        }
    ]
}

核心问题分析

你当前策略里的Resource填错了——sts:AssumeRole的目标资源是要切换的IAM角色ARN，不是用户自己的ARN，这是权限报错的根本原因。

修正步骤

获取目标角色ARN：找到你要让该IAM用户切换到的IAM角色，其ARN格式为arn:aws:iam::XXXXXXXXXXXXX:role/目标角色名称。
更新用户权限策略：将策略中的Resource替换为目标角色的ARN，示例如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::XXXXXXXXXXXXX:role/你的目标角色名"
        }
    ]
}

配置角色信任关系：确保目标角色的信任策略允许该IAM用户扮演它，示例配置：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXXXXXXXXXXXX:user/username"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}