在AWS中,更新角色的策略可能需要一些时间才能生效。可以采取以下两种方法进行解决:
update_assume_role_policy函数以更新角色策略,然后调用get_waiter来设置等待时间,直到角色策略更新成功:import boto3
# 定义 AWS 客户端
client = boto3.client('iam')
# 更新角色策略
updated_policy = {
'Version': '2012-10-17',
'Statement': [{
'Effect': 'Allow',
'Principal': {'Service': 'ec2.amazonaws.com'},
'Action': 'sts:AssumeRole'
}]
}
response = client.update_assume_role_policy(
RoleName='my-role',
PolicyDocument=json.dumps(updated_policy)
)
# 设置等待时间,直到更新成功
waiter = client.get_waiter('role_exists')
waiter.wait(RoleName='my-role')
import boto3
# 定义 AWS 客户端
client = boto3.client('iam')
# 获取原角色的所有信息
original_role = client.get_role(RoleName='my-role')
# 创建新角色
new_role = client.create_role(
RoleName='my-role',
AssumeRolePolicyDocument=json.dumps(original_role['AssumeRolePolicyDocument'])
)
# 给新角色添加策略
inline_policy = {
'Version': '2012-10-17',
'Statement': [{
'Effect': 'Allow',
'Action': 's3:*',
'Resource': '*'
}]
}
client.put_role_policy(
RoleName='my-role',
PolicyName='my-policy',
PolicyDocument=json.dumps(inline_policy)
)
# 给新角色添加托管策略
policy_arn = 'arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess'
client.attach_role_policy(
RoleName='my-role',
PolicyArn=policy_arn
)
# 将新角色与原角色进行交换
client.update_assume_role_policy(
RoleName='my-role',
PolicyDocument=json.dumps(original_role['AssumeRolePolicyDocument'])
)
client.delete