aws:RequestTag 在 s3 存储桶上不工作（在担任角色时）

Question

我对我承担的 IAM 角色有以下政策：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::mybucket/${aws:RequestTag/personalid}/*"
        }
    ]
}

执行代入角色时，我正在传递标签：

response = sts_client.assume_role(
       RoleArn=arn,
       RoleSessionName=role_session_name,
       Tags=[
          {
             'Key': 'personalid',
             'Value':'a'
          },
       ])

但是我在尝试读取文件夹 'a' 下的对象时被拒绝访问：

    s3 = boto3.resource(
      's3',
      aws_access_key_id=response['Credentials']['AccessKeyId'],
      aws_secret_access_key=response['Credentials']['SecretAccessKey'],
      aws_session_token=response['Credentials']['SessionToken'],
      region_name=client_main_region
   )
    obj = s3.Object('mybucket', f'a/file.txt')
    print(obj.get()['Body'].read().decode('utf-8'))

我用“principalTag”替换了策略，同时为角色添加了一个标签，它起作用了——我做错了什么？

=====

我尝试的另一件事是使用该 ID 和以下策略标记 s3 对象：

{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Condition": {
                "StringEqualsIfExists": {
                    "aws:RequestTag/personalid": "${s3:ExistingObjectTag/personalid}"
                }
            },
            "Resource": "arn:aws:s3:::mybucket/*"
        }

不工作

Answer 1

如果有人寻找这个 - 显然信任关系应该声明这些标签 - 这样它们就可用了：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123:role/lambda_role"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123:role/lambda_role"
      },
      "Action": "sts:TagSession",
      "Condition": {
        "StringLike": {
          "aws:RequestTag/personalid": "*"
        }
      }
    }
  ]
}

然后，我可以将此标签用作假定角色中的主要标签：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::mybucket/${aws:PrincipalTag/personalid}/*"
        }
    ]
}

aws:RequestTag 在 s3 存储桶上不工作（在担任角色时）

aws:RequestTag on s3 bucket is not working (while assuming a role)

amazon-web-services

amazon-iam

assume-role