☰

通过 AWS CLI 部署新版本所需的 ElasticBeanstalk 权限

tag-icon • tag-icon amazon-web-services elastic-beanstalk amazon-iam
通过 AWS CLI 部署新版本所需的 ElasticBeanstalk 权限

我有一个 IAM 策略设置，我认为它提供了正确的权限来将新版本部署到 Elastic Beanstalk 应用程序。但我仍然收到InsufficientPrivilegesException，具体来说：

aws elasticbeanstalk update-environment --environment-name LearnTfsBff --version-label LearnTfsBff-30

调用 UpdateEnvironment 操作时发生错误 (InsufficientPrivilegesException)：访问被拒绝

这是为部署用户设置的策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:*",
                "cloudformation:GetTemplate",
                "cloudformation:DescribeStackResource",
                "cloudformation:DescribeStackResources",
                "autoscaling:*",
                "cloudfront:CreateInvalidation",
                "ec2:describeVpcs",
                "ec2:DescribeImages",
                "elasticbeanstalk:CreateApplicationVersion",
                "elasticbeanstalk:DescribeApplications",
                "elasticbeanstalk:DescribeApplicationVersions",
                "elasticbeanstalk:DescribeEnvironments",
                "elasticbeanstalk:UpdateEnvironment",
                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                "elasticloadbalancing:DescribeInstanceHealth",
                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                "s3:ListAllMyBuckets",
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::learn-tfs-builds"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": "arn:aws:s3:::learn-tfs-*"
        }
    ]
}

我尝试将其添加"elasticbeanstalk:*"为允许的操作，但这并没有解决权限问题。我将其添加为允许的操作"*"，这确实解决了问题，但这不是允许的解决方案。

如何调试 AWS 中需要哪些特定权限？

谢谢，

山姆

答案1

从本指南看起来你可能也需要对 elastic beanstalk bucket 进行 S3 访问，例如：

{
"Action": [
 "s3:PutObject",
 "s3:PutObjectAcl",
 "s3:GetObject",
 "s3:GetObjectAcl",
 "s3:ListBucket",
 "s3:DeleteObject",
 "s3:GetBucketPolicy",
 "s3:CreateBucket"
],
"Effect": "Allow",
"Resource": [
 "arn:aws:s3:::elasticbeanstalk-[region]-[accountid]",
 "arn:aws:s3:::elasticbeanstalk-[region]-[accountid]/*"
]
}

相关内容