使用 Cognito 令牌访问 S3 时收到“AccessDenied”

我正在尝试在存储桶上使用“listObjects”操作。这是通过 WebService 访问的，我不想授予用户控制台访问权限。

角色政策

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "cognito-identity:*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::BucketName"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "${cognito-identity.amazonaws.com:sub}/*"
                    ]
                }
            }
        }
    ]
}

信托政策

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "somevalue"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}

如果我用实际值替换“${cognito-identity.amazonaws.com:sub}”，那么它就可以工作，否则它会给出 AccessDenied 错误。看来我错过了一些非常简单的事情。请帮忙。

Error :

cfId:undefined
code:"AccessDenied"
extendedRequestId:undefined
message:"Access Denied"
region:null
requestId:null
retryDelay:14.650563118124381
retryable:false
statusCode:403
time:Sun May 14 2017 23:11:57 GMT+0530
name:"AccessDenied"
stack:"AccessDenied: Access Denied↵    at constructor.extractError (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:11663)↵    at constructor.callListeners (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27756)↵    at constructor.emit (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27465)↵    at constructor.emitEvent (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:15469)↵    at constructor.e (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:11925)↵    at a.runTo (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:27302)↵    at http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:24:27509↵    at constructor.<anonymous> (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:12135)↵    at constructor.<anonymous> (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:15524)↵    at constructor.callListeners (http://localhost:8081/aws-cognito/aws-sdk-2.3.5.min.js:23:27862)"
__proto__:Object

事实证明，这对我来说是一个愚蠢的错误。 Sub 始终采用以下形式： us-east-1:12345678-1234-1234-1234-123456790ab。

我从 Cognito-idp 复制了 SUB，这是错误的。这是错误的 SUB。

SUB 是我们从 Cognito 身份池中获取的 IdentityId。

感谢您的关注。