Amazon web services 不能'；t既不通过AWS CLI也不通过AWS SDK访问Amazon SQS

我安装了aws cli并对其进行了配置。凭据文件位于~/.aws/credentials下。其内容如下：

[default]
aws_access_key_id = AKIA........PRYIA
aws_secret_access_key = OsLzxDH........HlPDt39lnY

下面是我在/.aws/config下的配置文件：

[default]
output = json
region = us-west-2

我在下面创建了一个队列。我可以在SQS管理控制台中将消息发送到队列

在IAM管理控制台中，我还向我的用户添加了AmazonSQSFullAccess策略

但是，当我想通过amazon sqs库（使用java）列出队列时，我得到了以下错误：

Access to the resource https://sqs.us-west-2.amazonaws.com/ is denied. (Service: AmazonSQS; Status Code: 403; Error Code: AccessDenied; Request ID: 44c3b1f1-cd8b-5306-b4d3-e0af4bf4ccbe)

因此，我认为该库可能有问题，我尝试通过aws cli使用命令“

aws sqs list queues

”进行访问。它抛出了下面的错误：

An error occurred (AccessDenied) when calling the ListQueues operation: Access to the resource https://us-west-2.queue.amazonaws.com/ is denied.

然后我添加了--debug选项并再次尝试获取队列列表。以下是输出：

aws sqs list-queues --debug
2017-04-05 16:33:06,781 - MainThread - awscli.clidriver - DEBUG - CLI version: aws-cli/1.11.66 Python/2.7.10 Darwin/15.6.0 botocore/1.5.29
2017-04-05 16:33:06,782 - MainThread - awscli.clidriver - DEBUG - Arguments entered to CLI: ['sqs', 'list-queues', '--debug']
2017-04-05 16:33:06,782 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function add_scalar_parsers at 0x10280fa28>
2017-04-05 16:33:06,782 - MainThread - botocore.hooks - DEBUG - Event session-initialized: calling handler <function inject_assume_role_provider_cache at 0x102530f50>
2017-04-05 16:33:06,783 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/data/sqs/2012-11-05/service-2.json
2017-04-05 16:33:06,788 - MainThread - botocore.hooks - DEBUG - Event service-data-loaded.sqs: calling handler <function register_retries_for_service at 0x10210ac08>
2017-04-05 16:33:06,788 - MainThread - botocore.handlers - DEBUG - Registering retry handlers for service: sqs
2017-04-05 16:33:06,788 - MainThread - botocore.hooks - DEBUG - Event building-command-table.sqs: calling handler <function add_waiters at 0x102819b18>
2017-04-05 16:33:06,792 - MainThread - awscli.clidriver - DEBUG - OrderedDict([(u'queue-name-prefix', <awscli.arguments.CLIArgument object at 0x102b97090>)])
2017-04-05 16:33:06,792 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.sqs.list-queues: calling handler <function add_streaming_output_arg at 0x10280fc80>
2017-04-05 16:33:06,792 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.sqs.list-queues: calling handler <function add_cli_input_json at 0x10253ad70>
2017-04-05 16:33:06,792 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.sqs.list-queues: calling handler <function unify_paging_params at 0x102796398>
2017-04-05 16:33:06,796 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/data/sqs/2012-11-05/paginators-1.json
2017-04-05 16:33:06,796 - MainThread - botocore.hooks - DEBUG - Event building-argument-table.sqs.list-queues: calling handler <function add_generate_skeleton at 0x102788758>
2017-04-05 16:33:06,796 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.sqs.list-queues: calling handler <bound method CliInputJSONArgument.override_required_args of <awscli.customizations.cliinputjson.CliInputJSONArgument object at 0x102b971d0>>
2017-04-05 16:33:06,796 - MainThread - botocore.hooks - DEBUG - Event before-building-argument-table-parser.sqs.list-queues: calling handler <bound method GenerateCliSkeletonArgument.override_required_args of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x102af0d90>>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.sqs.list-queues.queue-name-prefix: calling handler <function uri_param at 0x1023ca320>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.sqs.list-queues.cli-input-json: calling handler <function uri_param at 0x1023ca320>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event load-cli-arg.sqs.list-queues.generate-cli-skeleton: calling handler <function uri_param at 0x1023ca320>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event calling-command.sqs.list-queues: calling handler <bound method GenerateCliSkeletonArgument.generate_json_skeleton of <awscli.customizations.generatecliskeleton.GenerateCliSkeletonArgument object at 0x102af0d90>>
2017-04-05 16:33:06,797 - MainThread - botocore.hooks - DEBUG - Event calling-command.sqs.list-queues: calling handler <bound method CliInputJSONArgument.add_to_call_parameters of <awscli.customizations.cliinputjson.CliInputJSONArgument object at 0x102b971d0>>
2017-04-05 16:33:06,797 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2017-04-05 16:33:06,797 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2017-04-05 16:33:06,797 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2017-04-05 16:33:06,798 - MainThread - botocore.credentials - INFO - Found credentials in shared credentials file: ~/.aws/credentials
2017-04-05 16:33:06,798 - MainThread - botocore.loaders - DEBUG - Loading JSON file: /usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/data/endpoints.json
2017-04-05 16:33:06,811 - MainThread - botocore.client - DEBUG - Registering retry handlers for service: sqs
2017-04-05 16:33:06,812 - MainThread - botocore.hooks - DEBUG - Event creating-client-class.sqs: calling handler <function add_generate_presigned_url at 0x1020d2c80>
2017-04-05 16:33:06,813 - MainThread - botocore.args - DEBUG - The s3 config key is not a dictionary type, ignoring its value of: None
2017-04-05 16:33:06,816 - MainThread - botocore.endpoint - DEBUG - Setting sqs timeout as (60, 60)
2017-04-05 16:33:06,816 - MainThread - botocore.hooks - DEBUG - Event before-parameter-build.sqs.ListQueues: calling handler <function generate_idempotent_uuid at 0x10210a668>
2017-04-05 16:33:06,816 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=ListQueues) (verify_ssl=True) with params: {'body': {'Action': u'ListQueues', 'Version': u'2012-11-05'}, 'url': u'https://us-west-2.queue.amazonaws.com/', 'headers': {'User-Agent': 'aws-cli/1.11.66 Python/2.7.10 Darwin/15.6.0 botocore/1.5.29'}, 'context': {'client_region': 'us-west-2', 'has_streaming_input': False, 'client_config': <botocore.config.Config object at 0x102cfe310>}, 'query_string': '', 'url_path': '/', 'method': u'POST'}
2017-04-05 16:33:06,817 - MainThread - botocore.hooks - DEBUG - Event request-created.sqs.ListQueues: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x102cfe2d0>>
2017-04-05 16:33:06,817 - MainThread - botocore.auth - DEBUG - Calculating signature using v4 auth.
2017-04-05 16:33:06,817 - MainThread - botocore.auth - DEBUG - CanonicalRequest:
POST
/

host:us-west-2.queue.amazonaws.com
x-amz-date:20170405T133306Z

host;x-amz-date
48a38266faf90970d6c7fea9b15e6ba366e5f6397c2970fc893f8a7b5e207bd0
2017-04-05 16:33:06,817 - MainThread - botocore.auth - DEBUG - StringToSign:
AWS4-HMAC-SHA256
20170405T133306Z
20170405/us-west-2/sqs/aws4_request
1f88edf15f91a626575611ec61a7d614afbc73e004d619fff636cecdb06134b7
2017-04-05 16:33:06,817 - MainThread - botocore.auth - DEBUG - Signature:
52b3d7ed984353964a6528741b8dfd8acef536272541e912fcc5c89f14210252
2017-04-05 16:33:06,820 - MainThread - botocore.endpoint - DEBUG - Sending http request: <PreparedRequest [POST]>
2017-04-05 16:33:06,821 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - INFO - Starting new HTTPS connection (1): us-west-2.queue.amazonaws.com
2017-04-05 16:33:08,335 - MainThread - botocore.vendored.requests.packages.urllib3.connectionpool - DEBUG - "POST / HTTP/1.1" 403 321
2017-04-05 16:33:08,338 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-requestid': 'e107be92-7e65-535e-a29e-efcc8a36f565', 'content-length': '321', 'server': 'Server', 'connection': 'close', 'date': 'Wed, 05 Apr 2017 13:33:07 GMT', 'content-type': 'text/xml'}
2017-04-05 16:33:08,339 - MainThread - botocore.parsers - DEBUG - Response body:
<?xml version="1.0"?><ErrorResponse xmlns="http://queue.amazonaws.com/doc/2012-11-05/"><Error><Type>Sender</Type><Code>AccessDenied</Code><Message>Access to the resource https://us-west-2.queue.amazonaws.com/ is denied.</Message><Detail/></Error><RequestId>e107be92-7e65-535e-a29e-efcc8a36f565</RequestId></ErrorResponse>
2017-04-05 16:33:08,341 - MainThread - botocore.hooks - DEBUG - Event needs-retry.sqs.ListQueues: calling handler <botocore.retryhandler.RetryHandler object at 0x102af0c10>
2017-04-05 16:33:08,342 - MainThread - botocore.retryhandler - DEBUG - No retry needed.
2017-04-05 16:33:08,343 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 197, in main
    return command_table[parsed_args.command](remaining, parsed_args)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 333, in __call__
    return command_table[parsed_args.operation](remaining, parsed_globals)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 503, in __call__
    call_parameters, parsed_globals)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 622, in invoke
    client, operation_name, parameters, parsed_globals)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/awscli/clidriver.py", line 634, in _make_client_call
    **parameters)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/client.py", line 253, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/Cellar/awscli/1.11.66/libexec/lib/python2.7/site-packages/botocore/client.py", line 543, in _make_api_call
    raise error_class(parsed_response, operation_name)
ClientError: An error occurred (AccessDenied) when calling the ListQueues operation: Access to the resource https://us-west-2.queue.amazonaws.com/ is denied.
2017-04-05 16:33:08,343 - MainThread - awscli.clidriver - DEBUG - Exiting with rc 255

An error occurred (AccessDenied) when calling the ListQueues operation: Access to the resource https://us-west-2.queue.amazonaws.com/ is denied.

从调试日志中可以看到，它试图连接到us-west-2.queue.amazonaws.com。但是我在sqs.us-west-2.amazonaws.com下创建了队列。 可能它们被重定向到同一主机

那么我做错了什么？有什么想法吗

---

提前感谢。

导致访问被拒绝异常的原因是ForceMFA用于除IAM之外的所有aws服务。这就是我可以毫无问题地使用IAM命令的原因

以下是步骤：

我使用下面的命令创建了临时访问密钥

$aws sts获取会话令牌--mfa设备的序列号arn--令牌代码

然后，我将输出值放在单独的配置文件（例如mfa）中的凭证文件中

aws\u access\u key\u id=“返回输出中的访问密钥”

aws\u secret\u access\u key=“返回输出中的秘密访问密钥”

aws_session_token=“返回输出中的会话令牌”

然后我调用了队列列表命令，如下所示：

aws sqs列表队列--配置文件mfa

---

us-west-2.队列…

和

sqs.us-west-2…

在功能上应该是等效的。听起来好像有问题的凭据缺乏足够的权限。我已将AmazonSQSFullAccess策略附加到我的用户，但在IAM管理控制台->策略->AmazonSQSFullAccess描述中，它显示“通过AWS管理控制台提供对AmazonSQS的完全访问。”。这是否意味着该策略既不通过aws cli也不通过aws sdk提供访问？不，该策略适用于任何访问方法。验证您是否可以将aws cli上的这些凭据用于其他用途<代码>aws ec2描述可用性区域或

aws iam get user

例如？如果您非常确定在Accesskey ID和密钥上没有犯任何错误，请尝试使用策略模拟器验证用户是否确实具有授予的权限，我可以通过“aws iam list users”命令在我们的帐户下列出用户。“aws iam”相关命令正在成功运行。但是与“aws sqs”相关的命令失败了