可能会出现不能设置AWS Secrets Manager中的权限的情况。以下是一个示例代码,说明如何解决这个问题:
import boto3
from botocore.exceptions import ClientError
def add_secret_permissions(secret_name, role_name, region_name, permission):
"""
Adds permission to a secret for a specific AWS IAM role.
:param secret_name: The name of the secret.
:param role_name: The name of the AWS IAM role to grant access to the secret.
:param region_name: The AWS region where the secret is stored.
:param permission: The permission to grant. Can be 'ReadWrite' or 'ReadOnly'.
:return: True if permission was granted, False otherwise.
"""
# Create a new Secrets Manager client
client = boto3.client('secretsmanager', region_name=region_name)
# Define the policy to grant permission to the specified role
policy = {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"secretsmanager:GetResourcePolicy",
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret",
"secretsmanager:ListSecretVersionIds"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"secretsmanager:VersionStage": [
"AWSCURRENT",
]
}
}
}
]
}
# Grant permission based on the specified type
if permission == 'ReadWrite':
try:
response = client.put_secret_policy(
SecretId=secret_name,
ResourcePolicy=policy,
BlockPublicPolicy=True
)
except ClientError as e:
print("Error occurred while adding secret permission: ", e)
return False
elif permission == 'ReadOnly':
try:
response = client.add_resource_permission(
SecretId=secret_name,
Principal=role_name,
ResourcePolicy=policy,
BlockPublicPolicy=True,
SecretPermission='ReadOnly'
)