There is a problem with the permission policy configuration of the generated ec2 role, which prevents normal access to S3 resources - Githubissues

aws-quickstart / quickstart-clickhouse-cluster

AWS Quick Start Team

Apache License 2.0

14 stars 16 forks source link

There is a problem with the permission policy configuration of the generated ec2 role, which prevents normal access to S3 resources #58

Open lgb861213 opened 1 year ago

lgb861213 commented 1 year ago

the cloudformation policy is set Policies:

PolicyDocument: Statement:
- Effect: Allow Action:
  - logs:CreateLogGroup
  - logs:CreateLogStream
  - logs:PutLogEvents
  - logs:DescribeLogStreams Resource: !Sub arn:${InstanceRoleArn}:logs:${AWS::Region}:${AWS::AccountId}:log-group:${ClickHouseMainLogGroup}:*
- Effect: Allow Action:
  - s3:PutObjectAcl
  - s3:GetObjectAcl
  - s3:PutObject
  - s3:GetObject
  - s3:DeleteObject
  - s3:RestoreObject
  - s3:GetObjectVersion
  - s3:DeleteObjectVersion
  - s3:GetObjectRetention
  - s3:PutObjectRetention
  - s3:GetObjectVersionAcl
  - s3:PutObjectVersionAcl
  - s3:CreateBucket
  - s3:ListAllMyBuckets
  - s3:ListBucket
  - s3:PutBucketVersioning
  - s3:ListBucketVersions
  - s3:PutBucketLogging
  - s3:PutBucketAcl
  - s3:GetBucketAcl
  - s3:PutBucketPolicy
  - s3:GetBucketPolicy
  - s3:GetBucketLocation
  - s3:PutEncryptionConfiguration
  - s3:GetEncryptionConfiguration
  - s3:GetBucketVersioning
  - s3:GetLifecycleConfiguration
  - s3:GetIntelligentTieringConfiguration
  - s3:PutIntelligentTieringConfiguration
  - s3:PutLifecycleConfiguration Resource: !Sub arn:${InstanceRoleArn}:s3:::/

but the Resource correct should set fowllow: Resource: !Sub arn:${InstanceRoleArn}:s3:::*