无法使用 github 操作部署 aws beanstalk，获得 s3 访问被拒绝错误

Question

我有一个 Github 操作管道，可以成功创建 S3，然后将我的 war 文件上传到那里，但是在部署到 beanstalk 时，总是出现 s3 access denied 错误。下面是我的 build.yml 文件：

# This workflow will build a package using Maven and then publish it to GitHub packages when a release is created
# For more information see: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#apache-maven-with-a-settings-path

name: Maven Package

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - develop

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
    - uses: actions/checkout@v2
      name: Set up JDK 8

    - uses: actions/setup-java@v2
      with:
        java-version: '8'
        distribution: 'adopt'
        server-id: github # Value of the distributionManagement/repository/id field of the pom.xml
        settings-path: ${{ github.workspace }} # location for the settings.xml file

    - name: Build with Maven
      run: mvn -B package --file pom.xml

    - name: make a new dir and upload war in there
      run: mkdir staging && cp -r target/* staging

    - uses: actions/upload-artifact@v2
      with:
        name: Package
        path: staging

    - name: list all files
      run: ls && cd target && ls

    - name: Publish to GitHub Packages Apache Maven
      run: mvn deploy -s $GITHUB_WORKSPACE/settings.xml
      env:
        GITHUB_TOKEN: ${{ github.token }}

    - name: Deploy to EB
      uses: einaregilsson/beanstalk-deploy@v18
      with:
       aws_access_key: ${{ secrets.AWS_ACCESS_KEY_ID }}
       aws_secret_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       application_name: springbootwebapi
       environment_name: Springbootwebapi-env
       version_label: v1.0.10
       region: us-east-2
       deployment_package: target/login-0.0.2-SNAPSHOT.war

以下是来自 GitHub 操作的一些日志 sn-p：

没有给出现有的存储桶名称，正在创建/请求存储位置 将文件上传到存储桶 elasticbeanstalk-us-east-2-148565102071 新 构建成功上传到S3， 桶=elasticbeanstalk-us-east-2-148565102071， key=/springbootwebapi/v1-0-10.zip 创建新应用版本 Beanstalk 中的 v1.0.10。开始将版本 v1.0.10 部署到 环境 Springbootwebapi-env 部署开始， “wait_for_deployment”是真的……

18:17:02 信息：环境更新正在开始。 18:17:06 错误： 服务：Amazon S3，消息：访问被拒绝 18:17:06 错误：未能 部署应用程序。 18:17:07 错误：服务：Amazon S3，消息：访问 拒绝：S3Bucket=elasticbeanstalk-us-east-2-148565102071， S3Key=resources/environments/e-fp5bx3gtdn/_runtime/_versions/springbootwebapi/v1.0.10 18:17:13 错误：部署失败！当前状态：版本：示例 应用程序，运行状况：红色，运行状况：降级错误：部署 失败：错误：部署失败！当前状态：版本：示例 应用程序，运行状况：红色，运行状况：降级

不知道为什么上传成功后被拒绝访问。

更新 1：

我已经添加了以下权限，请参阅以下内容，但无法正常工作：

Answer 1

根据docs，您需要附加以下策略，以便 AWS 用户能够在使用您指定的 GitHub 操作时部署您的项目：

1. AWSElasticBeanstalkWebTier
2. AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy

添加上述内容将解决问题，同时还确保您在使用此 GitHub 操作时没有未来的问题。

Answer 2

从权限列表中删除AWSCompromisedKeyQuarantineV2 后，它可以成功运行。原因是这个权限实际上拒绝了对用户的几个相关操作，请参阅下面的 JSON 获取AWSCompromisedKeyQuarantineV2 的详细信息：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ec2:RequestSpotInstances",
                "ec2:RunInstances",
                "ec2:StartInstances",
                "iam:AddUserToGroup",
                "iam:AttachGroupPolicy",
                "iam:AttachRolePolicy",
                "iam:AttachUserPolicy",
                "iam:ChangePassword",
                "iam:CreateAccessKey",
                "iam:CreateInstanceProfile",
                "iam:CreateLoginProfile",
                "iam:CreatePolicyVersion",
                "iam:CreateRole",
                "iam:CreateUser",
                "iam:DetachUserPolicy",
                "iam:PassRole",
                "iam:PutGroupPolicy",
                "iam:PutRolePolicy",
                "iam:PutUserPermissionsBoundary",
                "iam:PutUserPolicy",
                "iam:SetDefaultPolicyVersion",
                "iam:UpdateAccessKey",
                "iam:UpdateAccountPasswordPolicy",
                "iam:UpdateAssumeRolePolicy",
                "iam:UpdateLoginProfile",
                "iam:UpdateUser",
                "lambda:AddLayerVersionPermission",
                "lambda:AddPermission",
                "lambda:CreateFunction",
                "lambda:GetPolicy",
                "lambda:ListTags",
                "lambda:PutProvisionedConcurrencyConfig",
                "lambda:TagResource",
                "lambda:UntagResource",
                "lambda:UpdateFunctionCode",
                "lightsail:Create*",
                "lightsail:Delete*",
                "lightsail:DownloadDefaultKeyPair",
                "lightsail:GetInstanceAccessDetails",
                "lightsail:Start*",
                "lightsail:Update*",
                "organizations:CreateAccount",
                "organizations:CreateOrganization",
                "organizations:InviteAccountToOrganization",
                "s3:DeleteBucket",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:PutLifecycleConfiguration",
                "s3:PutBucketAcl",
                "s3:DeleteBucketOwnershipControls",
                "s3:DeleteBucketPolicy",
                "s3:ObjectOwnerOverrideToBucketOwner",
                "s3:PutAccountPublicAccessBlock",
                "s3:PutBucketPolicy",
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}