使用OIDC与AWS和AWS一起使用OIDC时出错

Question

我试图在aws上使用带有角色和web身份的OIDC。我跟随着https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/的脚步

正如文章末尾所指出的，OIDC在我使用aws管道时可以工作，但是它不适用于导出和aws cli选项。

  default:
    - step:
        name: Connect to AWS using OIDC
        oidc: true
        script:
          - export AWS_REGION=$AWS_REGION
          - export AWS_ROLE_ARN=arn:aws:iam::1234567890:role/MyRole
          - export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
          - echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token
          - printenv BITBUCKET_STEP_OIDC_TOKEN
          - printenv AWS_REGION
          - printenv AWS_ROLE_ARN
          - aws sts assume-role-with-web-identity --role-arn arn:aws:iam::1234567890:role/MyRole --role-session-name build-session --web-identity-token "$BITBUCKET_STEP_OIDC_TOKEN" --duration-seconds 1000

PrintEnv输出：

printenv AWS_REGION
us-east-2

printenv AWS_ROLE_ARN
arn:aws:iam::1234567890:role/MyRole

printenv BITBUCKET_STEP_OIDC_TOKEN
<nothing here>

错误：

An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity

然而，当我使用管道时，一切正常。

  - pipe: atlassian/aws-s3-deploy:1.1.0
    variables:
      AWS_DEFAULT_REGION: $AWS_REGION # Optional if already defined in the context or OIDC used.
      AWS_OIDC_ROLE_ARN: $AWS_OIDC_ROLE_ARN # Optional by default. Required for OpenID Connect (OIDC) authentication.
      S3_BUCKET: mygreat-bucket
      LOCAL_PATH: 'build'
      CACHE_CONTROL: 'max-age=86400'

Answer 1

如果我正确理解，导出这些env变量就足够了，您不应该需要进一步的sts假设-角色与web标识命令。

只要试一试

aws sts get-caller-identity

Answer 2

我无意中发现了同样的事情-- BitBucket管道可以直接使用AWS，但是脚本不工作。如果您检查特定的管道源代码，您会发现需要一些额外的步骤来承担角色- https://bitbucket.org/atlassian/aws-s3-deploy/src/master/pipe/pipe.sh#lines-35。

因此，要使脚本部分与OIDC一起工作，您需要如下所示：

default:
- step:
    name: Connect to AWS using OIDC
    oidc: true
    script:
      - export AWS_REGION=$AWS_REGION
      - export AWS_ROLE_ARN=arn:aws:iam::1234567890:role/MyRole
      - export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
      - echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token
      - aws configure set web_identity_token_file ${AWS_WEB_IDENTITY_TOKEN_FILE}
      - aws configure set role_arn ${AWS_ROLE_ARN}
      - unset AWS_ACCESS_KEY_ID
      - unset AWS_SECRET_ACCESS_KEY
      - printenv BITBUCKET_STEP_OIDC_TOKEN
      - printenv AWS_REGION
      - printenv AWS_ROLE_ARN