☰

从 Amazon Kinesis 读取消息时出现 KMSAccessDeniedException

tag-icon • tag-icon encryption java streaming amazon-web-services
从 Amazon Kinesis 读取消息时出现 KMSAccessDeniedException

我一直尝试从 Kinesis Stream 中使用 Java 应用程序中的消息，该流由另一个 AWS 账户拥有。

当我阅读消息时，出现以下错误：

com.amazonaws.services.kinesis.model.AmazonKinesisException: User ARTRIOONHGFA4UYTVBSF3:crossAccountTest is not authorized to decrypt records in stream 123456123456:stream-name:1234567890 (Service: AmazonKinesis; Status Code: 400; Error Code: KMSAccessDeniedException; Request ID: 00000000-0000-0000-0000-0000000000)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1579)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1249)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1030)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:742)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:716)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667)
 at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649)
 at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513)
 at com.amazonaws.services.kinesis.AmazonKinesisClient.doInvoke(AmazonKinesisClient.java:1831)
 at com.amazonaws.services.kinesis.AmazonKinesisClient.invoke(AmazonKinesisClient.java:1807)
 at com.amazonaws.services.kinesis.AmazonKinesisClient.getRecords(AmazonKinesisClient.java:912)
 at com.kafka.connect.KinesisSourceTask.poll(KinesisSourceTask.java:89)
 at org.apache.kafka.connect.runtime.WorkerSourceTask.poll(WorkerSourceTask.java:244)
 at org.apache.kafka.connect.runtime.WorkerSourceTask.execute(WorkerSourceTask.java:220)
 at org.apache.kafka.connect.runtime.WorkerTask.doRun(WorkerTask.java:175)
 at org.apache.kafka.connect.runtime.WorkerTask.run(WorkerTask.java:219)
 at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at java.lang.Thread.run(Thread.java:748)

IAM 角色允许访问流和用于加密流的 KMS 密钥。我尝试在 CLI 上承担该角色并从那里使用消息，但出现了相同的错误消息。 An error occurred (KMSAccessDeniedException) when calling the GetRecords operation: User ARTRIOONHGFA4UYTVBSF3:crossAccountTest is not authorized to decrypt records in stream 123456123456:stream-name:1234567890

答案1

我发现用于加密流的 KMS 密钥没有明确的Allow权限来让假定的角色访问该密钥。

关键政策已更新，包括

{
            "Sid": "Allow use of the NDH Role Assuming Accessing the Kinesis Data Stream",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam:: 123456123456:role/assumed-role"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
                "arn:aws:kinesis:ap-southeast-2: 123456123456:stream/stream-name"
            ]
}

相关内容