Java 从EC2获取运动的问题

我有一些java代码，可以从Kinesis中提取记录。它在我的笔记本电脑上运行正常（不考虑IP），但当我尝试在EC2上运行它时，会出现以下错误：

Exception in thread "main" com.amazonaws.SdkClientException: Unable to load AWS credentials from any provider in the chain
  at com.amazonaws.auth.AWSCredentialsProviderChain.getCredentials(AWSCredentialsProviderChain.java:131)
  at com.amazonaws.http.AmazonHttpClient$RequestExecutor.getCredentialsFromContext(AmazonHttpClient.java:1119)
  at com.amazonaws.http.AmazonHttpClient$RequestExecutor.runBeforeRequestHandlers(AmazonHttpClient.java:759)
  at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:723)
  at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:716)
  at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699)
  at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667)
  at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649)
  at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513)
  at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.doInvoke(AWSSecurityTokenServiceClient.java:1271)
  at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.invoke(AWSSecurityTokenServiceClient.java:1247)
  at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.executeAssumeRole(AWSSecurityTokenServiceClient.java:454)
at com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient.assumeRole(AWSSecurityTokenServiceClient.java:431)

有问题的代码似乎让它不高兴：

AWSSecurityTokenServiceClient sts = new AWSSecurityTokenServiceClient();

AssumeRoleResult assumeRoleResult = sts.assumeRole(new AssumeRoleRequest()
            .withRoleArn(config.getString("kinesis/arn"))
            .withExternalId(config.getString("kinesis/external_id"))
            .withRoleSessionName(config.getString("kinesis/role_session_name")));

我想知道这是否与EC2实例是如何构建的有关。但事实上，它在我的调试器中运行良好，这让我感到困惑

我检查了一下以确保各种配置值都正确通过

---

Per@prayagupd Ive更新了EC2实例以包含此策略：

{
"Version": "2012-10-17",
"Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kinesis:Get*",
        "kinesis:List*",
        "kinesis:Describe*"
      ],
      "Resource": "*"
    }
  ]
}

现在的错误是：

Exception in thread "main" com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: 
User: arn:aws:sts::12345:assumed-role/kinesis-consumer/i-cab01a5 
is not authorized to perform: 
sts:AssumeRole on resource: arn:aws:iam::12345:role/kinesis-consumer 

---

从您的ec2，您需要通过您的服务器进行身份验证

我使用以下代码，该代码通过属性

AwsProfileNameLoader连接到kinesis。AWS\u PROFILE\u SYSTEM\u属性

在本地使用

（~/.AWS/credentials）

，对于我来说

~/.AWS/credentials

是临时的

因此，我在ec2内部使用

DefaultAWSCredentialsProviderChain

，它实际上查找ec2实例概要文件

您仍然可以将凭证放入

~/.aws/credentials

中并使用相同的凭证

/**
 * provides credentials for a client to make connection to the elastic cloud instance
 *
 * @return DefaultAWSCredentialsProviderChain
 */
private DefaultAWSCredentialsProviderChain getAuthProfileCredentials() {
    if (myAppConfig.getProperty("authentication.profile") != null) {
        System.setProperty(AwsProfileNameLoader.AWS_PROFILE_SYSTEM_PROPERTY, myAppConfig.getProperty("authentication.profile"));
    }
    return new DefaultAWSCredentialsProviderChain();
}

您的ec2实例配置文件需要具有以下信任关系

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

政策应该发挥什么样的作用

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kinesis:*"
            ],
            "Resource": [
                "arn:aws:kinesis:us-west-2:*:stream/*"
            ]
        }
    ]
}

然后，可以在ec2机器上使用以下命令验证动觉访问（

aws

cli应已安装）

---

AWS默认情况下会按此处列出的顺序（凭证链）查找凭证，是否确实按此处所述设置了凭证？什么是配置对象以及您是如何创建它的？我仍然不明白为什么我的代码会在开发笔记本电脑上运行，而不是在EC2上运行。您是否在本地使用

~/.aws/credentials

，并且令牌是否过期？有问题的凭据不是我的-它们是由Kinesis实例的所有者提供的。为什么它们可以在IDE中工作而不能在EC2中工作？看到了您更新的答案，现在您分配给EC2实例的角色似乎不起作用，但至少跳过了查找

~/.aws/credentials

。参考我的例子。您还可以在角色上检查此项吗？@ethrbunny请稍等。如果您的ec2计算机是Amazon Linux，您可以检查

aws kinesis list streams

？（我相信Amazon linux已经安装了aws cli），如果您没有为该ec2机器分配适当的角色，它将失败。因此，如果您解决了这个问题，那么您的代码也应该可以工作。

aws kinesis create-stream --stream-name gregor-samsa-ping --shard-count 1 --region us-west-2

aws kinesis list-streams --region us-west-2
{
    "StreamNames": [
        "gregor-samsa-ping"
    ]
}