Question

我有一个简单的iOS应用程序上传到s3。我正在尝试各处 - 尽管理想情况下我想做Facebook。

2个IAM角色（使用向导创建）。 IAM身份验证策略（用于unauth角色）：

{
    "Version": "2012-10-17",
    "Statement": [{
        "Action": [
            "mobileanalytics:PutEvents",
            "cognito-sync:*"
        ],
        "Effect": "Allow",
        "Resource": [
            "*"
        ]
      },
      {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::[mybucketname]/*"
    }

  ]
}

我的constants.h文件（擦洗）：

#define AWSID @"[12 digit num]"
#define PoolID @"us-east-1:[long id number]"
#define CRUnauth @"arn:aws:iam::[id num]:role/Cognito_Auth_DefaultRole"
#define CRAuth @"arn:aws:iam::[id num]:role/Cognito_auth_DefaultRole"

我的appDelegate.m文件包含：

credentialsProvider = [AWSCognitoCredentialsProvider credentialsWithRegionType:AWSRegionUSEast1 accountId:AWSID identityPoolId:PoolID unauthRoleArn:CRUnauth authRoleArn:nil];
AWSServiceConfiguration *configuration = [AWSServiceConfiguration configurationWithRegion:AWSRegionSAEast1
                                                                      credentialsProvider:credentialsProvider];
[AWSServiceManager defaultServiceManager].defaultServiceConfiguration = configuration;

由于我需要在某个时候添加Facebook登录，因此我将凭证提供给属性。

我只是上传一个捆绑图片来测试它。在我的viewController中：

 if([app.fb_token length] > 0){
        app.credentialsProvider.logins = @{ @(AWSCognitoLoginProviderKeyFacebook): app.fb_token };
    }
    AWSS3TransferManager *transferManager = [AWSS3TransferManager defaultS3TransferManager];
    UIImage *image = [UIImage imageNamed:@"yayDot"];
    NSArray *paths = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory,
                                                         NSUserDomainMask, YES);
    NSString *documentsDirectory = [paths objectAtIndex:0];
    NSString* path = [documentsDirectory stringByAppendingPathComponent:
                      @"yayDot.png" ];
    NSData* data = UIImagePNGRepresentation(image);
    [data writeToFile:path atomically:YES];

    AWSS3TransferManagerUploadRequest *uploadRequest = [AWSS3TransferManagerUploadRequest new];
    uploadRequest.body = [NSURL URLWithString:path];
    uploadRequest.key = @"yayDot.png";
    uploadRequest.bucket = thebucket;
    [AWSLogger defaultLogger].logLevel = AWSLogLevelVerbose;

    [[transferManager upload:uploadRequest] continueWithBlock:^id(BFTask *task) {
        // Do something with the response
        NSLog(@"result: %@", task.result);

        return nil;
    }];

完整错误：

AWSURLResponseSerialization.m line:258 | -[AWSXMLResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response header: [{
    "Content-Length" = 299;
    "Content-Type" = "text/xml";
    Date = "Tue, 27 Jan 2015 18:54:17 GMT";
    "x-amzn-RequestId" = "xxxxx";
}]
2015-01-27 10:54:18.052  AWSiOSSDKv2 [Verbose] AWSURLResponseSerialization.m line:263 | -[AWSXMLResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response body: [<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>AccessDenied</Code>
    <Message>Not authorized to perform sts:AssumeRoleWithWebIdentity</Message>
  </Error>
  <RequestId>xxxxx</RequestId>
</ErrorResponse>
]
2015-01-27 10:54:18.059 lookyloo[20024:332664] AWSiOSSDKv2 [Error] AWSCredentialsProvider.m line:587 | __40-[AWSCognitoCredentialsProvider refresh]_block_invoke356 | Unable to refresh. Error is [Error Domain=com.amazonaws.AWSSTSErrorDomain Code=0 "The operation couldn’t be completed. (com.amazonaws.AWSSTSErrorDomain error 0.)" UserInfo=0x7d936310 {Type=Sender, Message=Not authorized to perform sts:AssumeRoleWithWebIdentity, __text=(
    "\n    ",
    "\n    ",
    "\n    ",
    "\n  "
), Code=AccessDenied}]

Answer 1

查看您的代码，看起来您正在使用＆＃34; Auth＆＃34;角色arn:aws:iam::[id num]:role/Cognito_Auth_DefaultRole作为您的unauth角色。默认情况下，Amazon Cognito会创建仅信任特定访问类型（未经身份验证和身份验证）的角色，因此在尝试使用未经身份验证的访问时会出现sts错误。 This blog post通过信任政策并了解Cognito如何使用它们。

切换到简化的构造函数应该已经为您修复了此问题，除非您在AWS控制台内部也建立了相同的关联。通过在控制台中关联角色，您无需在应用程序中嵌入角色。

另外，如果您想使用＆＃34;美国标准＆＃34;以外的水桶？区域，您需要更改此行：

AWSServiceConfiguration *configuration = [AWSServiceConfiguration configurationWithRegion:AWSRegionSAEast1
                                                                  credentialsProvider:credentialsProvider];

反映存储区所在的区域。

未授权执行sts：AssumeRoleWithWebIdentity AWS s3 Cognito auth失败

1 个答案: