在使用Cognito令牌访问S3时获取"AccessDenied“

Question

我正在尝试对一个存储桶使用"listObjects“操作。这是通过WebService访问的，我不想给用户提供控制台访问权限。

角色策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "cognito-identity:*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::BucketName"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "${cognito-identity.amazonaws.com:sub}/*"
                    ]
                }
            }
        }
    ]
}

信任策略

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "somevalue"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}

如果我用实际值替换"${cognito-identity.amazonaws.com:sub}“，那么它可以工作，否则它会给出AccessDenied错误。似乎我遗漏了一些非常简单的东西。请帮帮忙。

错误：

cfId:undefined
code:"AccessDenied"
extendedRequestId:undefined
message:"Access Denied"
region:null
requestId:null
retryDelay:14.650563118124381
retryable:false
statusCode:403
time:Sun May 14 2017 23:11:57 GMT+0530
name:"AccessDenied"
stack:"AccessDenied: Access Denied↵    at constructor.extractError (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:11663)↵    at constructor.callListeners (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27756)↵    at constructor.emit (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27465)↵    at constructor.emitEvent (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:15469)↵    at constructor.e (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:11925)↵    at a.runTo (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:27302)↵    at http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:27509↵    at constructor.<anonymous> (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:12135)↵    at constructor.<anonymous> (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:15524)↵    at constructor.callListeners (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27862)"
__proto__:Object

Answer 1

事实证明，这是我的一个愚蠢的错误。Sub始终采用以下形式: us-east-1:12345678-1234-1234-1234-123456790ab.

我从Cognito-idp复制潜水艇，这是错误的。这是错误的潜艇。

SUB是我们从Cognito身份池中获得的IdentityId。

谢谢你的关注。