使用Java调用STS AssumeRole访问S3时遇403权限错误的解决咨询

我用以下Java代码尝试连接S3存储桶：

AssumeRoleRequest assumeRequest = new AssumeRoleRequest().withRoleArn("arn:aws:s3:::test");
AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder.standard()
    .withCredentials(new AWSStaticCredentialsProvider(new AWSCredentials......)).build();
AssumeRoleResult assumeResult = stsClient.assumeRole(assumeRequest);

配置时出现403权限错误：

Caused by: com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: User: arn:aws:iam::401532472896:user/test is not authorized to perform: sts:AssumeRole on resource: arn:aws:s3:::test  (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: 582c9c03-cd8e-43f7-bc35-8563461355e8; Proxy: null)

我创建了存储桶并附加了如下策略，但问题依旧：

{
    "Id": "Policy1567210887639",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1567210883302",
            "Action": [
                "sts:AssumeRole"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::123456789:user/test"
        }
    ]
}

1. 修正AssumeRole的目标ARN #

sts:AssumeRole操作的目标是IAM角色，不是S3存储桶。你代码里把S3桶的ARN传给withRoleArn()是完全错误的。需要先创建一个具备S3访问权限的IAM角色，使用该角色的ARN，格式为：
arn:aws:iam::你的AWS账户ID:role/角色名称

2. 修正用户的权限策略 #

当前附加的策略逻辑错误：sts:AssumeRole的Resource字段应该是你要切换到的IAM角色ARN，而非用户自身的ARN。正确的用户权限策略如下，将其附加到arn:aws:iam::401532472896:user/test用户上：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::你的AWS账户ID:role/目标角色名称"
        }
    ]
}

3. 配置目标IAM角色的信任策略 #

仅给用户权限还不够，目标IAM角色必须明确允许该用户扮演自己。给目标角色添加如下信任策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::401532472896:user/test"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

4. 给目标角色添加S3访问权限 #

目标IAM角色需要具备访问S3存储桶的权限，比如添加允许读写test桶的策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::test",
                "arn:aws:s3:::test/*"
            ]
        }
    ]
}

5. 修正Java代码 #

将代码中的RoleArn替换为正确的IAM角色ARN：

AssumeRoleRequest assumeRequest = new AssumeRoleRequest().withRoleArn("arn:aws:iam::你的AWS账户ID:role/目标角色名称");
// 其余代码保持不变

内容的提问来源于stack exchange，提问作者Peter Penzov