调用AWSConnectorsApi.modify_aws_connector：(500)试图更新DSM中现有的AWS帐户时发生异常

Question

我们正在通过TrendMicro deepsecurity(深度安全python模块)将AWS帐户登录到DSM。

我们可以通过API调用(create_aws_connector，delete_aws_connector of deep security module)成功地添加AWS帐户，从DSM中删除AWS帐户，方法是“使用CrossAccountRole.添加CrossAccountRole帐户”。

但如果有任何更新操作(如。若要更新任何AWS帐户的CrossAccountroleArn )，请通过深度安全模块的modify_aws_connector执行，将引发内部服务器错误。下面是API的使用方式。

api_instance =   deepsecurity.AWSConnectorsApi(deepsecurity.ApiClient(configuration))
aws_connector = deepsecurity.AWSConnector()

原木

An exception occurred when calling AWSConnectorsApi.modify_aws_connector: (500)
Reason:

HTTP response headers: 

HTTPHeaderDict({'Content-Type': 'application/json', 'Content-Length': '35', 'Connection': 'keep-alive', 'Date': 'Fri, 02 Jul 2021 12:17:23 GMT', 'Set-Cookie': 'AWSALB=GdmyPihxdVP+z7DwSuWUGHB+lQkMoTvtpkxqkfo1gmPj0Q8KOzB2x4jwP8/dR+W1GErItKrWcGy626I5ksfcQdotQVS6W07yD+QWOsI5fEGjVir0ZncFUqNxjG0d; Expires=Fri, 09 Jul 2021 12:17:22 GMT; Path=/, AWSALBCORS=GdmyPihxdVP+z7DwSuWUGHB+lQkMoTvtpkxqkfo1gmPj0Q8KOzB2x4jwP8/dR+W1GErItKrWcGy626I5ksfcQdotQVS6W07yD+QWOsI5fEGjVir0ZncFUqNxjG0d; Expires=Fri, 09 Jul 2021 12:17:22 GMT; Path=/; SameSite=None; Secure', 'X-Frame-Options': 'SAMEORIGIN', 'Content-Security-Policy-Report-Only': "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.gstatic.com www.google.com; frame-src 'self' www.google.com *.trendmicro.com; frame-ancestors 'self'; style-src 'self' 'unsafe-inline' blob:; img-src 'self' data: *.trendmicro.com; font-src 'self' data: *.trendmicro.com; form-action 'self'; report-uri https://app.deepsecurity.trendmicro.com/?CSP", 'X-XSS-Protection': '1;mode=block', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload', 'Cache-Control': 'no-cache,no-store', 'Pragma': 'no-cache', 'X-DSM-Version': 'Deep Security/50.0.449', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 6cf3af2e109d98f9560bab7a34d3d10f.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'MAA51-C2', 'X-Amz-Cf-Id': '8oesetz7Qn4FgLj6XyeSuBZrEfR-MOly7DSuA-EAUG7eeIbKk1fV0Q=='})

HTTP response body: {"message”: “Internal server error"}

Answer 1

要分配的IAM角色(或附加策略)中有一个错误。

我建议您使用可以通过CloudFormation提供的预先配置的交叉帐户角色。但是，如果这是不可能的，我建议确保您的IAM角色具有以下信任关系：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::147995105371:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<your Deep Security ExternalID>"
        }
      }
    }
  ]
}

这里的关键是AWS帐户arn:aws:iam::147995105371:root。此帐户由趋势控制，用于提供连接器。