启动AWS DMS任务的数据管道AWSCLI -->无权执行: dms:StartReplicationTask

Question

在运行数据管道来调度数据库迁移任务时，是否有人遇到过“未授权执行: dms:StartReplicationTask”的问题？

An error occurred (AccessDeniedException) when calling the StartReplicationTask operation: User: arn:aws:sts::myaccount123:assumed-role/DataPipelineDefaultResourceRole/i-06cd6897b81348197 is not authorized to perform: dms:StartReplicationTask on resource: arn:aws:dms:us-east-1:myaccount123:task:PSNZBU57OTT54JOOABSMHV5WYI
errorStackTrace

amazonaws.datapipeline.taskrunner.TaskExecutionException: An error occurred (AccessDeniedException) when calling the StartReplicationTask operation: User: arn:aws:sts::myaccount123:assumed-role/DataPipelineDefaultResourceRole/i-06cd6897b81348197 is not authorized to perform: dms:StartReplicationTask on resource: arn:aws:dms:us-east-1:myaccount123:task:PSNZBU57OTT54JOOABSMHV5WYI at amazonaws.datapipeline.activity.ShellCommandActivity.runActivity(ShellCommandActivity.java:93) at amazonaws.datapipeline.objects.AbstractActivity.run(AbstractActivity.java:16) at amazonaws.datapipeline.taskrunner.TaskPoller.executeRemoteRunner(TaskPoller.java:136) at amazonaws.datapipeline.taskrunner.TaskPoller.executeTask(TaskPoller.java:105) at amazonaws.datapipeline.taskrunner.TaskPoller$1.run(TaskPoller.java:81) at private.com.amazonaws.services.datapipeline.poller.PollWorker.executeWork(PollWorker.java:76) at private.com.amazonaws.services.datapipeline.poller.PollWorker.run(PollWorker.java:53) at java.lang.Thread.run(Thread.java:748) 

当我运行此任务时

aws dms start-replication-task --replication-task-arn arn:aws:dms:us-east-1:myaccount123:task:PSNZBU57OTT54JOOABSMHV5WYI --start-replication-task-type reload-target

使用AWSCLI作为我自己，一切都很好。

似乎我没有为启动DataPipeline任务的STS和DMS API设置正确的预授权。我使用的是Data Pipepline web界面，并检查了所有的策略和角色是否都已到位：

AmazonDMSCloudWatchLogsRole 
AmazonDMSRedshiftS3Role 
AmazonDMSVPCManagementRole 
AWSMigrationHubDMSAccess 

AmazonDynamoDBFullAccesswithDataPipeline 
AmazonEC2RoleforDataPipelineRole 
AWSDataPipeline_FullAccess 
AWSDataPipelineRole 

Answer 1

您似乎没有从数据管道执行DMS task的正确权限，要执行此操作，您需要确保将此IAM POLICY分配给管道中已使用的IAM ROLE：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "dms:StartReplicationTask"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

要阐明您能够从AWS CLI成功执行任务的原因:是因为CLI使用您的configured ，而您可能已向用户分配了某个针对DMS的完全访问权限角色。为了从数据管道运行它，您需要将权限分配给IAM角色。

P.D:这只是您所需权限的一个示例，您可能需要管道的其他权限，或者您可能需要将策略更多地限制为一个或多个资源。