问题描述
我正在尝试使用 node.js 库连接到亚马逊销售合作伙伴 API (SP-API),但遇到了一个极其奇怪的错误,这似乎是在告诉我我无法承担自己的角色?
CustomError: User: arn:aws:iam::11111:user/bob is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::11111:user/bob
我对 AWS 还很陌生,但我很确定这个针对用户的内联策略应该足以满足我想要做的事情,我什至使它适用于所有资源,而不仅仅是 SellingPartners我之前创建的角色:
{
"Version": "2012-10-17","Statement": [
{
"Sid": "VisualEditor0","Effect": "Allow","Action": "sts:AssumeRole","Resource": "*"
}
]
}
这是我的完整代码,以防万一:
const SellingPartnerAPI = require('amazon-sp-api');
(async() => {
try {
let sellingPartner = new SellingPartnerAPI({
region:'na',// The region to use for the SP-API endpoints ("eu","na" or "fe")
refresh_token:'xxxxxx',// The refresh token of your app user
credentials:{
SELLING_PARTNER_APP_CLIENT_ID:'xxxxx',SELLING_PARTNER_APP_CLIENT_SECRET:'xxxxx',AWS_ACCESS_KEY_ID:'xxxx',AWS_SECRET_ACCESS_KEY:'xxxxx',AWS_SELLING_PARTNER_ROLE:'arn:aws:iam::11111:user/bob'
}
});
let res = await sellingPartner.callAPI({
operation:'getorders',endpoint:'orders'
});
console.log(res);
} catch(e) {
console.log(e);
}
})();
解决方法
ARN arn:aws:iam::11111:user/bob
描述的是用户而不是角色。
如果客户端需要角色 ARN,它可能应该类似于 arn:aws:iam::11111:role/your-role-name
。