AWS胶木星笔记本无法对用户进行身份验证

Question

当我开始使用IAM角色AWSGlueServiceNotebookRoleDefault作业时，出现了以下错误：

由于请求中缺少信息，未能对用户进行身份验证。

文档中没有有关此错误的信息。

我做的每件事都从这和这，我有两个桶爬虫-公共服务和aws-胶服务。

GlueServiceNotebookPolicyDefault

{  
    "Version":"2012-10-17",
    "Statement":[  
       {  
          "Effect":"Allow",
          "Action":[  
             "glue:CreateDatabase",
             "glue:CreatePartition",
             "glue:CreateTable",
             "glue:DeleteDatabase",
             "glue:DeletePartition",
             "glue:DeleteTable",
             "glue:GetDatabase",
             "glue:GetDatabases",
             "glue:GetPartition",
             "glue:GetPartitions",
             "glue:GetTable",
             "glue:GetTableVersions",
             "glue:GetTables",
             "glue:UpdateDatabase",
             "glue:UpdatePartition",
             "glue:UpdateTable",
             "glue:GetJobBookmark",
             "glue:ResetJobBookmark",
             "glue:CreateConnection",
             "glue:CreateJob",
             "glue:DeleteConnection",
             "glue:DeleteJob",
             "glue:GetConnection",
             "glue:GetConnections",
             "glue:GetDevEndpoint",
             "glue:GetDevEndpoints",
             "glue:GetJob",
             "glue:GetJobs",
             "glue:UpdateJob",
             "glue:BatchDeleteConnection",
             "glue:UpdateConnection",
             "glue:GetUserDefinedFunction",
             "glue:UpdateUserDefinedFunction",
             "glue:GetUserDefinedFunctions",
             "glue:DeleteUserDefinedFunction",
             "glue:CreateUserDefinedFunction",
             "glue:BatchGetPartition",
             "glue:BatchDeletePartition",
             "glue:BatchCreatePartition",
             "glue:BatchDeleteTable",
             "glue:UpdateDevEndpoint",
             "s3:GetBucketLocation",
             "s3:ListBucket",
             "s3:ListAllMyBuckets",
             "s3:GetBucketAcl"
          ],
          "Resource":[  
             "*"
          ]
       },
       {  
          "Effect":"Allow",
          "Action":[  
             "s3:GetObject"
          ],
          "Resource":[  
             "arn:aws:s3:::crawler-public*",
             "arn:aws:s3:::aws-glue*"
          ]
       },
       {  
          "Effect":"Allow",
          "Action":[  
             "s3:PutObject",
             "s3:DeleteObject"          
          ],
          "Resource":[  
             "arn:aws:s3:::aws-glue*"
          ]
       },
       {  
          "Effect":"Allow",
          "Action":[  
             "ec2:CreateTags",
             "ec2:DeleteTags"
          ],
          "Condition":{  
             "ForAllValues:StringEquals":{  
                "aws:TagKeys":[  
                   "aws-glue-service-resource"
                ]
             }
          },
          "Resource":[  
             "arn:aws:ec2:*:*:network-interface/*",
             "arn:aws:ec2:*:*:security-group/*",
             "arn:aws:ec2:*:*:instance/*"
          ]
       },
       {  
         "Effect":"Allow",
         "Action":[  
            "kms:Decrypt"
         ],
         "Resource":[  
            "arn:aws:kms:*:id:key/key-id"
         ]
      }
    ]
 }

AWSGlueServiceNotebookRoleDefault

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "glue.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

怎么解决这个问题？谢谢!

Answer 1

这种奇怪的行为在Safari中重现。在Chrome中，一切都是完美的。

Answer 2

我也遇到了同样的问题使用铬。通过在用户定义的设置下转到Chrome -> Settings -> Cookies ->添加一个总是允许名为"*.aws.amazon.com“的cookie的网站来解决这个问题

我相信你的角色很好。

Answer 3

默认情况下，这是Safari阻塞第三方cookie。笔记本域和AWS控制台域是不同的，Safari会因为隐私(跟踪)问题而阻止跨站点cookie。

您可以允许笔记本域或禁用第三方cookie阻塞在Safari。