GitHub Action执行AWS Staging环境DB迁移报sts:TagSession权限错误原因咨询

计划通过GitHub Action在AWS Staging环境执行DB迁移操作，对应工作流配置如下：

name: db migration for stg.

on:
  push:
    branches:
      - staging
    paths:
      - api/db/migrate/**

jobs:
  migration:
    name: DB Migration
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v1
    with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN_STG }}
      role-duration-seconds: 1200
      aws-region: ap-northeast-1
     - uses: ruby/setup-ruby@v1
     with:
      ruby-version: '2.7.2'
     - name: ssh configure
       env:
         SSH_SECRET_KEY: ${{ secrets.SSH_SECRET_KEY }}
       run: |
         mkdir -p ~/.ssh && touch ~/.ssh/config
         echo 'host i-* mi-*' >> ~/.ssh/config
         echo '  ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"' >> ~/.ssh/config
         echo $SSH_SECRET_KEY | base64 -d > ~/.ssh/id_rsa2
         chmod 0600 ~/.ssh/id_rsa2
      - name: db migration
        env:
          RAILS_ENV: <env>
          RAILS_MASTER_KEY: <key>
          RDS_HOSTNAME: 127.0.0.1
          RDS_DB_NAME: <db_name>
          RDS_USERNAME: <username>
          RDS_PASSWORD: <password>
          RDS_PORT: 9999
          STEP_SERVER_ID: <id>
          DB_HOST: <host>
          working-directory: ./api
          run: |
            ssh -f -N -L $RDS_PORT:$DB_HOST:3306 -i ~/.ssh/id_rsa2 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ssm-user@$STEP_SERVER_ID
            sudo apt-get -yqq install libpq-dev
            gem install bundler
            bundle install --jobs 4 --retry 3
            bundle exec rails db:migrate

工作流运行到aws-actions/configure-aws-credentials@v1步骤时触发如下报错：

Run aws-actions/configure-aws-credentials@v1
 with:
  aws-access-key-id: ***
  aws-secret-access-key: ***
  role-to-assume: ***
  role-duration-seconds: 1200
  aws-region: ap-northeast-1

Error: User: arn:aws:iam::***:user/github_user is not authorized to perform: sts:TagSession on resource: ***

当前使用的github_user IAM权限策略如下：

{
  "Version": "2012-10-17",
  "Statement": [
     {
        "Effect": "Allow",
        "Action": "sts:*",
        "Resource": "*"
     }
   ] 
}

核心原理 #

aws-actions/configure-aws-credentials Action默认会在AssumeRole时自动添加GitHub上下文相关的会话标签（仓库名、工作流名称、操作人等），该操作需要调用sts:TagSession接口，你现有配置的权限不满足该接口的调用要求。

可能的具体原因 #

• 目标Assume角色（即AWS_ASSUME_ROLE_ARN_STG对应的IAM角色）的信任策略未允许sts:TagSession操作：你给github_user配置的sts:*权限仅代表该用户有调用STS接口的权限，但目标角色的信任策略是独立的校验环节，必须在信任策略中显式允许主体执行sts:TagSession才能正常打会话标签。
• 你使用的AWS账号属于组织架构，存在SCP（服务控制策略）限制了sts:TagSession操作的调用，或者目标角色附加的权限边界禁止了该操作。

快速解决方案 #

你可以直接关闭Action的会话标签功能，跳过sts:TagSession的调用，修改Action配置添加role-skip-session-tagging: true参数即可：

- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v1
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN_STG }}
    role-duration-seconds: 1200
    aws-region: ap-northeast-1
    role-skip-session-tagging: true # 新增该参数关闭标签功能

完整权限解决方案 #

如果需要保留会话标签功能，你需要修改目标Assume角色的信任策略，添加sts:TagSession的允许规则，示例如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::***:user/github_user"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}

你提供的工作流配置存在多处缩进错误，例如uses: aws-actions/configure-aws-credentials@v1、uses: ruby/setup-ruby@v1等行的缩进层级不符合yaml规范，修复权限问题后需要同步修正缩进才能保证工作流正常运行。

内容的提问来源于stack exchange，提问作者Ragnar921