![AWS CodeBuild 脚本因 AccessDenied 而导致 s3 同步失败](https://linux22.com/image/708774/AWS%20CodeBuild%20%E8%84%9A%E6%9C%AC%E5%9B%A0%20AccessDenied%20%E8%80%8C%E5%AF%BC%E8%87%B4%20s3%20%E5%90%8C%E6%AD%A5%E5%A4%B1%E8%B4%A5.png)
我正在使用 CodeBuild
- 图片:aws/codebuild/nodejs:7.0.0
- 服务角色:code-buid-some-service-role
在我的 buildspec 中运行以下命令
aws s3 sync ./webroot s3://s3-us-west-2.amazonaws.com/some-amazing-s3-bucket/test
这是存储桶策略:
{
"Version": "2012-10-17",
"Id": "Policy1502332584348",
"Statement": [
{
"Sid": "Stmt1502332580996",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789:role/service-role/code-buid-some-service-role"
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::some-amazing-s3-bucket/*",
"arn:aws:s3:::some-amazing-s3-bucket"
]
}
]
}
代码构建失败,原因如下:
[Container] 2017/08/10 02:41:16 Running command aws s3 sync ./webroot s3://s3-us-west-2.amazonaws.com/some-amazing-s3-bucket/test
fatal error: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied
我遗漏了什么?我在测试时将存储桶策略完全打开,但仍然失败。
答案1
将以下内容添加到 CodeBuild 生成的角色对我来说很有用:
{
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::mytestbucket",
"arn:aws:s3:::mytestbucket/*"
],
"Action": [
"s3:PutObject",
"s3:Get*",
"s3:List*"
]
}
答案2
我遇到了同样的错误,并尝试了此线程中的所有方法。我试图
aws s3 sync ./build s3://s3-us-east-1.amazonaws.com/some-amazing-s3-bucket
来自 Codebuild 操作,但 S3 响应始终
fatal error: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied
即使我是通过笔记本电脑上的 aws-cli (使用管理员访问密钥) 执行此操作的。
我花了几个小时才意识到实际的 s3 url 应该这样写:
s3://some-amazing-s3-bucket
代替
s3://s3-us-east-1.amazonaws.com/some-amazing-s3-bucket
话虽如此,像 tedsmitt 这样的政策也必须附加到(就我而言)codebuild 角色。
希望这对某人有帮助。