我正在使用CloudCheckr.com，并按照build议在当前没有活动的地区启用AWS Config。
理想情况下，我想设置每个区域使用相同的S3桶和SNS主题从默认区域（因为它已经设置），但我得到的错误，如：
Last AWS Error Message: User: arn:aws:sts::XXXXXXX:assumed-role/config-role/AWSConfig-Delivery is not authorized to perform: SNS:Publish on resource: arn:aws:sns:eu-west-1:XXXXXXX:assumed:config-topic (Service: AmazonSNS; Status Code: 403; Error Code: AuthorizationError; ... 我已经尝试使用以下策略设置configurationangular色IAM用户：
{ "Version": "2012-10-17", "Statement": [{ "Action": [ "appstream:Get*", "autoscaling:Describe*", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Get*", "cloudfront:List*", "cloudtrail:DescribeTrails", "cloudtrail:GetTrailStatus", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "config:Put*", "directconnect:Describe*", "dynamodb:GetItem", "dynamodb:BatchGetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:DescribeTable", "dynamodb:ListTables", "ec2:Describe*", "elasticache:Describe*", "elasticbeanstalk:Check*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticbeanstalk:RequestEnvironmentInfo", "elasticbeanstalk:RetrieveEnvironmentInfo", "elasticloadbalancing:Describe*", "elastictranscoder:Read*", "elastictranscoder:List*", "iam:List*", "iam:Get*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "opsworks:Describe*", "opsworks:Get*", "route53:Get*", "route53:List*", "redshift:Describe*", "redshift:ViewQueriesInConsole", "rds:Describe*", "rds:ListTagsForResource", "s3:Get*", "s3:List*", "sdb:GetAttributes", "sdb:List*", "sdb:Select*", "ses:Get*", "ses:List*", "sns:Get*", "sns:List*", "sqs:GetQueueAttributes", "sqs:ListQueues", "sqs:ReceiveMessage", "storagegateway:List*", "storagegateway:Describe*", "trustedadvisor:Describe*" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:PutObject*" ], "Resource": [ "arn:aws:s3:::config-bucket-XXXXXXXXXXXX/AWSLogs/XXXXXXXXXXXX/*" ], "Condition": { "StringLike": { "s3:x-amz-acl": "bucket-owner-full-control" } } }, { "Effect": "Allow", "Action": [ "s3:GetBucketAcl" ], "Resource": "arn:aws:s3:::config-bucket-XXXXXXXXXXXX" }, { "Effect": "Allow", "Action": "sns:Publish", "Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXXX:config-topic" }] }
但是这似乎并没有给予正确的许可。 我不断收到：
The provided SNS topic ARN is invalid.
即使我是积极的，这是现有话题的正确的ARN。
这是SNS ARN的权限：
{ "Version": "2008-10-17", "Id": "__default_policy_ID", "Statement": [ { "Sid": "__default_statement_ID", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "SNS:ListSubscriptionsByTopic", "SNS:Subscribe", "SNS:DeleteTopic", "SNS:GetTopicAttributes", "SNS:Publish", "SNS:RemovePermission", "SNS:AddPermission", "SNS:Receive", "SNS:SetTopicAttributes" ], "Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXXX:config-topic", "Condition": { "StringEquals": { "AWS:SourceOwner": "XXXXXXXXXXXX" } } }, { "Sid": "__console_pub_0", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::XXXXXXXXXXXX:root" ] }, "Action": "SNS:Publish", "Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXXX:config-topic" }, { "Sid": "__console_sub_0", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::XXXXXXXXXXXX:root" }, "Action": [ "SNS:Subscribe", "SNS:Receive" ], "Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXXX:config-topic" } ] }
有人曾经这样做过？
更好的是，有没有人有脚本可能会build立一个区域？
您可以在技术上发布跨地区的SNS主题，但是我会在您设置服务的每个区域创build主题（例如，在EU West的IAM策略中使用eu-west-1进行SNS），然后将所有这些消息从不同的在您select的家庭区域中有一个SQS队列。
如果您仍想继续沿着已经build立的path，则需要确保您的IAMangular色在SNS发布权限中具有正确的区域（应该是eu-west-1而不是us-east-1