AWS Cognito PHP 开发者身份验证

Question

试图使用PHP SDK实现开发者身份验证，但是一直出现以下错误：

致命错误：未捕获的Aws\CognitoIdentity\Exception\CognitoIdentityException: AWS错误代码：AccessDeniedException，状态码：400，AWS请求ID：da162f98-fb50-11e4-937e-0bf2642a4752，AWS错误类型：客户端，AWS错误消息：用户：arn:aws:iam::256661818246:user/tester未被授权执行cognito-identity:GetOpenIdTokenForDeveloperIdentity操作，资源：arn:aws:cognito-identity:us-east-1:256661818246:identitypool/us-east-1:69767873-2de2-4cc7-a78f-3d18b5e9bf71，User-Agent：aws-sdk-php2/2.8.3 Guzzle/3。9.3 curl/7.20.0 PHP/5.3.6，在/var/www/html/aws/Aws/Common/Exception/NamespaceExceptionFactory.php的第91行抛出

这是我的示例代码：

<?php
session_start();

//Include AWS client libs
require (dirname(__DIR__).'/aws/aws-autoloader.php');
use Aws\CognitoIdentity\CognitoIdentityClient;
use Aws\Sts\StsClient;

/* Global Vars */
$aws_region = 'us-east-1';
$aws_key = '<AWS_KEY>';
$aws_secret = '<AWS_SECRET>';
$aws_account_id = '<AWS_ACCOUNT_ID>';
$identity_pool_id = 'us-east-1:xxxx-xxxx-xxxx-xxxx';

//Initialize a Cognito Identity Client using the Factory
$client = CognitoIdentityClient::factory(array('region' => $aws_region, 'key' => $aws_key, 'secret' => $aws_secret));

/* Acquire new Identity */
$identity = $client->getOpenIdTokenForDeveloperIdentity(array('IdentityPoolId' => $identity_pool_id, 'Logins' => array('login.custom.traffic' => 'jkljkasdjk')));

//Obtain Identity from response data structure
$id = $identity->get('IdentityId');
echo "IdentityId: ".$id;
?>

我怀疑在获取开发者身份时出现了错误。我缺少什么？

- user1048839

Answer 1

这个错误的原因可能是IAM用户"tester"没有附加策略。 您可以从IAM控制台附加一个已有的策略"AmazonCognitoDeveloperAuthenticatedIdentities"，该策略将允许这个用户访问Cognito API，包括"getOpenIdTokenForDeveloperIdentity"。

- Vinay Kushwaha

---

谢谢Vinay。正如你所说，我花了很多时间在Cognito的身份池中搜索，而不是IAM。 - user1048839