使用Java AWS开发工具包在Ceph对象网关上创建角色时发生异常

问题描述

我正在尝试遵循Ceph文档的examples来使用Java AWS SDK（v.2.5.16）测试其STS功能。在调用IamClient的createRole方法时，它在过程的早期就失败了。抛出的异常是：

position: relative

所以没什么可继续的。

在调用API时使用其凭据的用户具有以下设置 （通过在命令行上运行software.amazon.awssdk.services.iam.model.IamException: null (Service: Iam,Status Code: 403,Request ID: tx0000000000000000000f4-005f689d69-396f9b-default) at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.handleErrorResponse(HandleResponseStage.java:115) at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.handleResponse(HandleResponseStage.java:73) at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.execute(HandleResponseStage.java:58) at software.amazon.awssdk.core.internal.http.pipeline.stages.HandleResponseStage.execute(HandleResponseStage.java:41) at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:64) at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:36) at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:77) at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:39) at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage$RetryExecutor.doExecute(RetryableStage.java:113) at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage$RetryExecutor.execute(RetryableStage.java:86) at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:62) at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:42) at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:57) at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:37) at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.executeWithTimer(ApiCallTimeoutTrackingStage.java:80) at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:60) at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:42) at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206) at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:37) at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:26) at software.amazon.awssdk.core.internal.http.AmazonSyncHttpClient$RequestExecutionBuilderImpl.execute(AmazonSyncHttpClient.java:240) at software.amazon.awssdk.core.client.handler.BaseSyncClientHandler.invoke(BaseSyncClientHandler.java:96) at software.amazon.awssdk.core.client.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:120) at software.amazon.awssdk.core.client.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:73) at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:44) at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:55) at software.amazon.awssdk.services.iam.DefaultIamClient.createRole(DefaultIamClient.java:1406) 获得

radosgw-admin user info --uid admin-api-user

当我不尝试使用Java SDK创建角色时，我通过运行在命令行中创建

{
    "user_id": "admin-api-user","display_name": "Admin API User","email": "","suspended": 0,"max_buckets": 1000,"subusers": [],"keys": [
        {
            "user": "admin-api-user","access_key": "abc","secret_key": "xyz"
        }
    ],"swift_keys": [],"caps": [
        {
            "type": "buckets","perm": "*"
        },{
            "type": "metadata",{
            "type": "usage",{
            "type": "users",{
            "type": "zone","perm": "*"
        }
    ],"op_mask": "read,write,delete","default_placement": "","default_storage_class": "","placement_tags": [],"bucket_quota": {
        "enabled": false,"check_on_raw": false,"max_size": -1,"max_size_kb": 0,"max_objects": -1
    },"user_quota": {
        "enabled": false,"temp_url_keys": [],"type": "rgw","mfa_ids": []
}

工作正常。任何暗示可能导致问题的提示将不胜感激！

解决方法

没关系，我只是发现documentation并未列出可以分配给用户的所有可用管理功能。因此，除了上面的用户信息列表中的内容外，还可以添加两个其他角色，即“角色”和“用户策略”。我在this邮件列表条目的用户信息样本中偶然发现了这些内容。 一旦添加了“角色”功能，createRole调用就会成功。