浏览器中通过Amazon Cognito用JavaScript访问DynamoDB遇权限错误求助

我看你在浏览器环境下用JavaScript通过Cognito身份池访问DynamoDB时，碰到了CredentialsError，核心提示是加载凭证失败且出现Access denied。先看看你的代码和错误信息：

你的代码 #

<script> 
AWS.config.region = "eu-west-1"; 
AWS.config.credentials = new AWS.CognitoIdentityCredentials({ 
  IdentityPoolId: "eu-west-1:...", 
  RoleArn: "arn:aws:iam::..." 
}); 
var db = new AWS.DynamoDB.DocumentClient(); 
function readItem() { 
  var table = "parklot"; 
  var date = "2019-07-17 08:27:27.524955"; 
  var params = { 
    TableName: table, 
    Key:{ 
      "date": date 
    } 
  }; 
  db.get(params, function(err, data) { 
    if (err) { 
      document.getElementById('textarea').innerHTML = "Unable to read item: " + "\n" + JSON.stringify(err, undefined, 2); 
    } else { 
      document.getElementById('textarea').innerHTML = "GetItem succeeded: " + "\n" + JSON.stringify(data, undefined, 2); 
    } 
  }); 
} 
readItem(); 
</script>

错误信息 #

{
  "message": "Missing credentials in config",
  "code": "CredentialsError",
  "time": "2019-07-19T08:42:08.570Z",
  "requestId": "1953c431-aa01-11e9-9128-415a65efdf67",
  "statusCode": 403,
  "retryable": false,
  "retryDelay": 63.05053729604022,
  "originalError": {
    "message": "Could not load credentials from constructor",
    "code": "CredentialsError",
    "time": "2019-07-19T08:42:08.570Z",
    "requestId": "1953c431-aa01-11e9-9128-415a65efdf67",
    "statusCode": 403,
    "retryable": false,
    "retryDelay": 63.05053729604022,
    "originalError": {
      "message": "Access denied",
      "code": "AccessDenied",
      "time": "2019-07-19T08:42:08.567Z",
      "requestId": "1953c431-aa01-11e9-9128-415a65efdf67",
      "statusCode": 403,
      "retryable": false,
      "retryDelay": 63.05053729604022
    }
  }
}

问题分析与解决步骤 #

这个错误的核心原因是Cognito凭证初始化流程错误，再加上可能的权限配置问题，我给你整理了几个关键修复点：

• 移除构造参数里的RoleArn：当你使用IdentityPoolId初始化AWS.CognitoIdentityCredentials时，Cognito会自动根据用户身份（匿名/已认证）分配对应的IAM角色，手动传入RoleArn会干扰这个自动匹配流程，直接删掉这个参数就好。

• 确保IAM角色有DynamoDB访问权限：去IAM控制台找到你身份池对应的未认证/已认证角色，添加一个精准的权限策略，允许GetItem操作访问目标表。示例策略如下：

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "dynamodb:GetItem",
        "Resource": "arn:aws:dynamodb:eu-west-1:你的AWS账号ID:table/parklot"
      }
    ]
  }
  

  记得替换成你自己的AWS账号ID和表的完整ARN，尽量不要给过于宽泛的权限。

• 等待凭证就绪后再操作DynamoDB：浏览器端的Cognito凭证需要主动获取，初始化后不会立即就绪。你可以通过get()方法的回调确保凭证加载完成后，再执行DynamoDB操作。修改后的代码如下：

  <script> 
  AWS.config.region = "eu-west-1"; 
  AWS.config.credentials = new AWS.CognitoIdentityCredentials({ 
    IdentityPoolId: "eu-west-1:你的身份池ID" // 已移除RoleArn
  }); 
  
  // 先获取凭证，就绪后再执行DB操作
  AWS.config.credentials.get(function(err) {
    if (err) {
      console.error(err);
      document.getElementById('textarea').innerHTML = "凭证获取失败: " + JSON.stringify(err, undefined, 2);
      return;
    }
  
    // 凭证就绪后初始化DocumentClient
    var db = new AWS.DynamoDB.DocumentClient(); 
    function readItem() { 
      var table = "parklot"; 
      var date = "2019-07-17 08:27:27.524955"; 
      var params = { 
        TableName: table, 
        Key:{ 
          "date": date 
        } 
      }; 
      db.get(params, function(err, data) { 
        if (err) { 
          document.getElementById('textarea').innerHTML = "Unable to read item: " + "\n" + JSON.stringify(err, undefined, 2); 
        } else { 
          document.getElementById('textarea').innerHTML = "GetItem succeeded: " + "\n" + JSON.stringify(data, undefined, 2); 
        } 
      }); 
    } 
    readItem(); 
  });
  </script>
  

• 检查身份池的未认证用户访问设置：如果你的场景是匿名用户访问，需要确保Cognito身份池的“未认证用户访问”选项已经开启，否则无法获取匿名凭证。

内容的提问来源于stack exchange，提问作者batupaksoy