担任角色：无法从系统设置加载凭据

Question

创建 Java 应用程序并部署在 EC2 实例中，将 EC2 实例配置文件角色与实例相关联

通过 AWS Java SDK V2 和 V1 调用 AWS API 时出现以下错误

KmsClient client = KmsClient.builder().region(amazonSessionMapper.getRegion()).build();

无法从系统设置加载凭据。必须通过环境变量 (AWS_ACCESS_KEY_ID) 或系统属性 (aws.accessKeyId) 指定访问密钥。

是否有任何与权限/设置相关的内容

注意：我不想在应用程序中使用 Access Key 和 Secret Key，我想使用 STS 承担角色

FINEST|1432182/0|Service controller|22-01-20 13:49:37|software.amazon.awssdk.core.exception.SdkClientException: 
Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID)
 or system property (aws.accessKeyId). FINEST|1432182/0|Service controller|22-01-20 13:49:37|   
 at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:98) ~[software.amazon.awssdk-sdk-core-2.16.84.jar:?] 
 FINEST|1432182/0|Service controller|22-01-20 13:49:37| at software.amazon.awssdk.auth.credentials.internal.SystemSettingsCredentialsProvider.
 resolveCredentials(SystemSettingsCredentialsProvider.java:58) ~[software.amazon.awssdk-auth-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37|  
 at software.amazon.awssdk.auth.credentials.AwsCredentialsProviderChain.resolveCredentials(AwsCredentialsProviderChain.java:91) 
 ~[software.amazon.awssdk-auth-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37|    
 at software.amazon.awssdk.auth.credentials.internal.LazyAwsCredentialsProvider.resolveCredentials(LazyAwsCredentialsProvider.java:45) 
 ~[software.amazon.awssdk-auth-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37|    
 at software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider.resolveCredentials(DefaultCredentialsProvider.java:104) 
 ~[software.amazon.awssdk-auth-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37|    
 at software.amazon.awssdk.awscore.client.handler.AwsClientHandlerUtils.createExecutionContext(AwsClientHandlerUtils.java:79) 
 ~[software.amazon.awssdk-aws-core-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37|    
 at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.createExecutionContext(AwsSyncClientHandler.java:68) 
 ~[software.amazon.awssdk-aws-core-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37|    
 at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:99) 
 ~[software.amazon.awssdk-sdk-core-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37|    
 at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:169) 
 [software.amazon.awssdk-sdk-core-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37| 
 at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:95) 
 [software.amazon.awssdk-sdk-core-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37| 
 at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45) 
 [software.amazon.awssdk-sdk-core-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37| 
 at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:55) 
 [software.amazon.awssdk-aws-core-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37| 
 at software.amazon.awssdk.services.kms.DefaultKmsClient.listAliases(DefaultKmsClient.java:4466) 
 [software.amazon.awssdk-kms-2.16.84.jar:?] FINEST|1432182/0|Service controller|22-01-20 13:49:37|  
at software.amazon.awssdk.services.kms.KmsClient.listAliases(KmsClient.java:7885) [software.amazon.awssdk-kms-2.16.84.jar:?]ases(KmsClient.java:7885) [software.amazon.awssdk-kms-2.16.84.jar:?]

Answer 1

您需要创建一个 credentialsProvider 并在您的客户端中使用：

AWSCredentialsProvider credentialsProvider = new DefaultAWSCredentialsProviderChain();

然后您将能够通过.withCredentials 方法使用此提供程序：

 AWSKMS kmsClient = AWSKMSClientBuilder.standard()
                .withCredentials(credentialsProvider)
                .withRegion("us-east-1")
                .build();