问题描述
我正在尝试为 eks 设置 eksctl 但它抛出
"Error: unable to determine AMI to use: error getting AMI from SSM Parameter Store: AccessDeniedException: User: arn:aws:iam:::user/cnc is not authorized to perform: ssm:GetParameter on resource: arn:aws:ssm:us-east-1::parameter/aws/service/eks/optimized-ami/1.18/amazon-linux-2/recommended/image_id".
我使用的 IAM 权限策略是
"Version": "2012-10-17","Statement": [
{
"Effect": "Allow","Action": [
"ssm:DescribeParameters"
],"Resource": "*"
},{
"Effect": "Allow","Action": [
"ssm:GetParameters","ssm:GetParametersByPath"
],"Resource": "arn:aws:ssm:::parameter/*"
}
]
我也尝试使用策略模拟来检查权限,它给了我“隐式拒绝(无匹配语句)”
解决方法
我认为您可能还需要授权“ssm:GetParameter”操作。
,我遇到了同样的问题。我解决它的方法是将区域添加到 ssm 资源。并且还添加了一个 ssm:GetParameter 像这样:
"Version": "2012-10-17","Statement": [
{
"Effect": "Allow","Action":[
"ssm:DescribeParameters"
],"Resource": "*"
},{
"Effect": "Allow","Action":[
"ssm:GetParameters","ssm:GetParameter","ssm:GetParametersByPath"
],"Resource": "arn:aws:ssm:ca-central-1::parameter/*"
}
]
如果您注意到我添加了区域 ca-central-1,您应该将其更改为您当前的区域。