新手求助：从EC2实例的PHP文件连接DynamoDB失败

Hey Ahmed, I’ve helped a few folks work through this exact issue—let’s break down why your connection might be failing and fix it step by step.

1. IAM Roles > Hardcoded Credentials (The #1 Fix) #

First off, hardcoding your access key and secret in the PHP file is not just bad practice—it might not even be the root problem here. EC2 instances are designed to use IAM roles to access AWS services securely, without needing to embed credentials in code.

• What to do:
  • Head to the AWS IAM console, create a new role with permissions for DynamoDB (start with AmazonDynamoDBFullAccess for testing, then narrow it down later).
  • Attach this role to your EC2 instance (you can do this via the EC2 console under "Actions" > "Security" > "Modify IAM role").
  • Update your code to remove the credentials block entirely—the AWS SDK will automatically pull credentials from the instance’s metadata:

    require 'vendor/autoload.php';
    use Aws\DynamoDb\DynamoDbClient;
    
    try {
        $client = new DynamoDbClient([
            'region' => 'us-east-1',
            'version' => 'latest'
        ]);
    
        // Test the connection with a simple call
        $tableList = $client->listTables();
        echo "Connected! Your tables: " . implode(', ', $tableList['TableNames']);
    } catch (Exception $e) {
        echo "Connection failed: " . $e->getMessage();
    }
    

2. Check Network & Security Group Rules #

Even if your credentials are good, your EC2 instance might not be able to reach DynamoDB:

• Security Group: Make sure your EC2’s security group has an outbound rule allowing HTTPS (port 443) traffic to 0.0.0.0/0 (or the DynamoDB service endpoints for your region).
• VPC Access: If your EC2 is in a private subnet, ensure you have a NAT Gateway for internet access, or set up a VPC endpoint for DynamoDB to bypass the internet.

3. Verify SDK Installation & Credential Validity #

• Composer Setup: Double-check that you ran composer require aws/aws-sdk-php in your project directory—if vendor/autoload.php is missing, the SDK won’t load.
• Credential Test (If You Must Use Hardcoded): If you’re sticking with hardcoded keys temporarily, confirm they’re valid by running this AWS CLI command on your EC2 instance:

  aws dynamodb list-tables --region us-east-1 --access-key YOUR_KEY --secret-key YOUR_SECRET
  

  If this fails, your keys are either invalid or lack DynamoDB permissions.

4. Confirm Region Match #

Ensure the region in your code matches where your DynamoDB tables are hosted. If your tables are in eu-west-1 instead of us-east-1, the connection will fail silently (or throw a "resource not found" error).

Quick Debug Tip #

Adding a try/catch block like in the code above will give you a specific error message—this is way more helpful than just knowing "it didn’t work." Common errors might include "permission denied," "unable to resolve host," or "invalid credentials."

内容的提问来源于stack exchange，提问作者Ahmed