在python中使用cognito获取AWS凭证boto

Question

我在尝试模拟我的服务器应用程序使用我自己的身份验证为移动设备创建临时访问/密钥对的流程。移动设备与我的服务器通话，最终结果是它获得AWS凭证。

我使用Cognito和自定义开发人员后端see documentation here。

为此，我做了下面的脚本，但我的秘密/访问密钥证书不起作用：

import time 
import traceback 
from boto.cognito.identity.layer1 import CognitoIdentityConnection 
from boto.sts import STSConnection 
from boto.s3.connection import S3Connection 
from boto.s3.key import Key 


AWS_ACCESS_KEY_ID = "XXXXX" 
AWS_SECRET_ACCESS_KEY = "XXXXXX" 


# get token 
iden_pool_id = "us-east-1:xxx-xxx-xxx-xxxx-xxxx" 
role_arn = "arn:aws:iam::xxxx:role/xxxxxxx" 
user_id = "xxxx" 
role_session_name = "my_session_name_here" 
bucket_name = 'xxxxxxxxxx' 


connection = CognitoIdentityConnection(aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY) 

web_identity_token = connection.get_open_id_token_for_developer_identity(
    identity_pool_id=iden_pool_id, 
    logins={"xxxxxxxxx" : user_id}, 
    identity_id=None, 
    token_duration=3600) 


# use token to get credentials 
sts_conn = STSConnection(aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY) 
result = sts_conn.assume_role_with_web_identity(
    role_arn, 
    role_session_name, 
    web_identity_token['Token'], 
    provider_id=None, 
    policy=None, 
    duration_seconds=3600) 

print "The user now has an access ID (%s) and a secret access key (%s) and a session/security token (%s)!" % (
    result.credentials.access_key, result.credentials.secret_key, result.credentials.session_token) 

# just use any call that tests if these credentials work 
from boto.ec2.connection import EC2Connection 
ec2 = EC2Connection(result.credentials.access_key, result.credentials.secret_key, security_token=result.credentials.session_token) 
wait = 1 
cumulative_wait_time = 0 
while True: 
    try: 
     print ec2.get_all_regions() 
     break 
    except Exception as e: 
     print e, traceback.format_exc() 
     time.sleep(2**wait) 
     cumulative_wait_time += 2**wait 
     print "Waited for:", cumulative_wait_time 
     wait += 1 

我与指数退避想到的是，也许Cognito需要一段时间才能传播新的访问/秘密密钥对，因此我可能不得不等待（如果是这样，这是非常不可接受的！）。

但是，这个脚本运行了10分钟，并没有成功，这导致我相信这个问题是别的。

控制台打印出来：

The user now has an access ID (xxxxxxxx) and a secret access key (xxxxxxxxxx) and a session/security token (XX...XX)! 

EC2ResponseError: 401 Unauthorized 
<?xml version="1.0" encoding="UTF-8"?> 
<Response><Errors><Error><Code>AuthFailure</Code><Message>AWS was not able to validate the provided access credentials</Message></Error></Errors><RequestID>xxxxxxxxxx</RequestID></Response> Traceback (most recent call last): 
    File "/home/me/script.py", line 50, in <module> 
    print ec2.get_all_regions() 
    File "/home/me/.virtualenvs/venv/local/lib/python2.7/site-packages/boto/ec2/connection.py", line 3477, in get_all_regions 
    [('item', RegionInfo)], verb='POST') 
    File "/home/me/.virtualenvs/venv/local/lib/python2.7/site-packages/boto/connection.py", line 1186, in get_list 
    raise self.ResponseError(response.status, response.reason, body) 
EC2ResponseError: EC2ResponseError: 401 Unauthorized 
<?xml version="1.0" encoding="UTF-8"?> 
<Response><Errors><Error><Code>AuthFailure</Code><Message>AWS was not able to validate the provided access credentials</Message></Error></Errors><RequestID>xxxxxxxxxxxxx</RequestID></Response> 

Waited for: 2 
... 
... 

有什么想法？

Answer 1

您正在从assume_role_with_web_identity调用的结果中提取访问密钥和密钥。但是，使用临时凭证时，您还需要使用结果中的安全凭证。

下面是伪代码说明你需要做什么： http://docs.aws.amazon.com/STS/latest/UsingSTS/using-temp-creds.html#using-temp-creds-sdk

另请注意EC2Connection 的security_token参数http://boto.readthedocs.org/en/latest/ref/ec2.html#boto.ec2.connection.EC2Connection

希望这可以解决问题

马克