Cloud Formation Template：403，而文件是从私有 S3 复制的

Question

需要帮助。尝试使用以下模板创建安装了 Java 的 Windows EC2。但是，当从我的私有 S3 存储桶复制工件时，我得到 403。访问 S3 和 EC2 实例的角色创建得很好。可能是什么问题？

Resources:

  EC2S3Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Principal:
              Service: ec2.amazonaws.com
            Effect: Allow
            Sid: ''
      Policies:
        - PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Action:
                  - 's3:GetObject'
                Resource: "arn:aws:s3:::windowsartifcats"
                Effect: Allow
          PolicyName: AuthenticatedS3GetObjects
          
  EC2S3InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref EC2S3Role
          
  JavaSeleniumEC2Instance:
    Type: "AWS::EC2::Instance"
    Properties:
      KeyName: "windowskeypair"
      ImageId: ami-0229f7666f517b31e
      InstanceType: "t2.micro"
      SecurityGroups:
        - "windows"
      IamInstanceProfile: !Ref EC2S3InstanceProfile
      UserData:
        Fn::Base64: !Join
                    - ""
                    - - "<script> cfn-init.exe -v -s "
                      - !Ref "AWS::StackId"
                      - " -r JavaSeleniumEC2Instance --region "
                      - !Ref "AWS::Region"
                      - "</script>"
    
    Metadata:
      AWS::CloudFormation::Authentication:
          S3AccessCreds:
            Type: "S3"
            buckets:
              - "windowsartifcats"
            roleName:
              !Ref EC2S3Role
      AWS::CloudFormation::Init:
          config:
            files:
              "c:\\Install-Java-JDK.ps1":
                content: !Join
                  - ''
                  - - 'Set-Location C:\\;'
                    - '.\\jdk-11.0.9_windows-x64_bin.exe /s'
              "c:\\jdk-11.0.9_windows-x64_bin.exe":
                source: "https://windowsartifcats.s3.us-east-1.amazonaws.com/jdk-11.0.9_windows-x64_bin.exe"
              "c:\\IEDriverServer.exe":
                source: "https://windowsartifcats.s3.us-east-1.amazonaws.com/IEDriverServer.exe"

            commands:
              "JavaInstall":
                command: "powershell.exe -ExecutionPolicy RemoteSigned -Command c:\\Install-Java-JDK.ps1"
                waitAfterCompletion: '180'

来自 C:\cfn\log.cfn-init 的日志：

2020-12-21 06:28:15,608 [错误] 在构建配置期间遇到错误：无法检索 https://windowsartifcats.s3.us-east-1.amazonaws.com/IEDriverServer.exe：HTTP 错误 403

Answer 1

您的EC2S3Role 不正确。以下

Resource: "arn:aws:s3:::windowsartifcats"

仅指存储桶，而不是其对象。为了能够下载存储桶中的对象，它应该是：

Resource: "arn:aws:s3:::windowsartifcats/*"