我正在尝试使用boto3从供应商的S3存储桶将文件复制到我的S3存储桶。我使用sts服务来扮演角色以访问供应商的s3存储桶。我能够连接到供应商存储桶并获取存储桶列表。但是,当复制到我的存储桶时,我遇到了CopyObject操作:拒绝访问
错误。以下是我的脚本:
session = boto3.session.Session(profile_name="s3_transfer")
sts_client = session.client("sts", verify=False)
assumed_role_object = sts_client.assume_role(
RoleArn="arn:aws:iam::<accountid>:role/assumedrole",
RoleSessionName="transfer_session",
ExternalId="<ID>",
DurationSeconds=18000,
)
creds = assumed_role_object["Credentials"]
src_s3 = boto3.client(
"s3",
aws_access_key_id=creds["AccessKeyId"],
aws_secret_access_key=creds["SecretAccessKey"],
aws_session_token=creds["SessionToken"],
verify=False,
)
paginator =src_s3.get_paginator("list_objects_v2")
# testing with just 2 items.
# TODO: Remove MaxItems once script works.
pages = paginator.paginate(
Bucket="ven_bucket", Prefix="client", PaginationConfig={"MaxItems": 2, "PageSize": 1000}
)
dest_s3 = session.client("s3", verify=False)
for page in pages:
for obj in page["Contents"]:
src_key = obj["Key"]
des_key = dest_prefix + src_key[len(src_prefix) :]
src = {"Bucket": "ven_bucket", "Key": src_key}
print(src)
print(des_key)
dest_s3.copy(src, "my-bucket", des_key, SourceClient=src_s3)
错误发生在 dest_s3.copy...
这一行。我有以下 AWS 用户策略,允许将文件复制到我的存储桶。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::my-bucket/*",
"arn:aws:s3:::my-bucket/"
]
}
]
}
在运行上述脚本时,出现以下错误:
botocore.exceptions.ClientError: 调用CopyObject操作时发生错误(Access Denied):访问被拒绝。