How to give permission to a federated user in boto

问题:

Tried figuring out from the documentation but can not create a federated user who can access the s3 bucket

First the imports

>>> from boto.s3.connection import S3Connection
>>> from boto.sts import STSConnection

Then create a bucket in s3

>>> s3c = ('access key', 'secret key')  
>>> s3c.create_bucket('ranjith_new_bucket')

Then create a federated user, which if I correctly understand, is a way of creating temporary credentials

>>> sts = STSConnection('access key', 'secret key')  
>>> user = sts.get_federation_token('guest_user_1')

But when I try to get the list of all accessible buckets, I get an error.

>>> s3c2 = S3Connection(user.credentials.access_key, user.credentials.secret_key)
>>> s3c2.get_all_buckets()

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/ranjith/work/venv/local/lib/python2.7/site-packages/boto-2.16.0-py2.7.egg/boto/s3/connection.py", line 387, in get_all_buckets
    response.status, response.reason, body)
boto.exception.S3ResponseError: S3ResponseError: 403 Forbidden
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidAccessKeyId</Code><Message>The AWS Access Key Id you provided does not exist in our records.</Message><RequestId>154CDA2184E00650</RequestId><HostId>xxx</HostId><AWSAccessKeyId>xxx</AWSAccessKeyId></Error>

The documentation says that I have to provide an policy string, but the documentation is very tough to digest. I know I have to define a policy somewhere and use it while creating federated user but not sure where or how to do just that.

I did try this:

permission = {
  "Version": "2012-10-17",
  "Statement": [
    {
       "Effect": "Allow",
       "Action": ["sts:GetFederationToken"],
       "Resource": "*"
     },
    {
       "Effect": "Allow",
       "Action": ["s3:*"],
       "Resource": "arn:aws:s3:::mybucket/ranjith_new_bucket/*"
     }
   ]
 }

sts.get_federation_token('some_other_user', json.dumps(permission))

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/ranjith/work/venv/local/lib/python2.7/site-packages/boto-2.16.0-py2.7.egg/boto/sts/connection.py", line 235, in get_federation_token
    FederationToken, verb='POST')
  File "/home/ranjith/work/venv/local/lib/python2.7/site-packages/boto-2.16.0-py2.7.egg/boto/connection.py", line 1138, in get_object
    raise self.ResponseError(response.status, response.reason, body)
boto.exception.BotoServerError: BotoServerError: 400 Bad Request
<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>MalformedInput</Code>
  </Error>
  <RequestId>75734932-4ac1-11e3-a17b-e9e245983c07</RequestId>
</ErrorResponse>

which is really silly because all I did is to put in json dump of the policy. I am not even able to find any online resources for the problem.

It would be great if some one could guide me so that I end up creating a federated user with access to ranjith_new_bucket created above. Code snippets will be appreciated.

回答1:

The FederationToken object returned from this call:

>>> user = sts.get_federation_token('guest_user_1')

has an attribute called credentials and this sub-object contains an access_key, a secret_key, and a session_token. All three of these need to be sent in the request. You are currently only sending the access_key and secret_key. I think if you change your code to look like this:

> s3c2 = S3Connection(user.credentials.access_key, user.credentials.secret_key, security_token=user.credentials.session_token)

You should be okay.