没有凭据无法从 ec2 实例在 SNS 上发布答案

【问题标题】：Unable to publish on SNS from ec2 instance without credentials没有凭据无法从 ec2 实例在 SNS 上发布
【发布时间】：2022-11-23 22:14:58
【问题描述】：

我正在尝试从 ec2 实例发布到 sns（角色与此实例关联，允许它发布）

$client = new StsClient([
    'profile' => 'default',
    'region' => 'ap-southeast-1',
    'version' => 'latest'
]);

$roleToAssumeArn = 'arn:aws:iam::xxxxxxxx:role/MYSNSROLE';

try {
    $result = $client->assumeRole([
        'RoleArn' => $roleToAssumeArn,
        'RoleSessionName' => 'session1'
    ]);
    // output AssumedRole credentials, you can use these credentials
    // to initiate a new AWS Service client with the IAM Role's permissions
       
    
    $client = new SnsClient([
        'region'      => 'ap-southeast-1',
        'version'     => 'latest',
        'credentials' =>  [
            'key'    => $result['Credentials']['AccessKeyId'],
            'secret' => $result['Credentials']['SecretAccessKey'],
            'token'  => $result['Credentials']['SessionToken']
        ]
    ]);
    
    
    return $client;

    
} catch (AwsException $e) {
    // output error message if fails
    error_log($e->getMessage());
}

当代码尝试运行时显示以下错误无法从 /home/web app/.aws/credentials 874/var/app/current/vendor/aws/aws-sdk-php/src/Credentials/CredentialProvider.php 读取凭据

【问题讨论】：

请阐明您的具体问题或提供更多详细信息以准确突出您的需求。正如目前所写的那样，很难准确地说出你在问什么。

标签： php amazon-web-services amazon-iam amazon-sns

【解决方案1】：

如果您尝试使用'AwsCredentialsAssumeRoleCredentialProvider' 通过担任角色来创建凭据，则需要提供带有'StsClient' 对象和'assume_role_params' 详细信息的'client' 信息，如图所示。

use AwsCredentialsCredentialProvider;
use AwsCredentialsInstanceProfileProvider;
use AwsCredentialsAssumeRoleCredentialProvider;
use AwsS3SnsClient;
use AwsStsStsClient;

// Passing AwsCredentialsAssumeRoleCredentialProvider options directly
$profile = new InstanceProfileProvider();
$ARN = "arn:aws:iam::123456789012:role/xaccounts3access";
$sessionName = "s3-access-example";

$assumeRoleCredentials = new AssumeRoleCredentialProvider([
    'client' => new StsClient([
        'region' => 'ap-southeast-1',
        'version' => '2011-06-15',
        'credentials' => $profile
    ]),
    'assume_role_params' => [
        'RoleArn' => $ARN,
        'RoleSessionName' => $sessionName,
    ],
]);


$client = new SnsClient([
    'region'      => 'ap-southeast-1',
    'version'     => '2006-03-01',
    'credentials' => $provider
]);

希望这会有所帮助。

【讨论】：