amazon-web-services - 请求中包含的安全 token 已过期

Question

我有一个脚本可以从 Cloudwatch 中提取大量指标用于我们自己的内部报告。

该脚本迭代特定区域中的所有 EC2 实例，并询问过去 2 周的 5 个 cloudwatch 指标(所有可用的统计数据)(每 5 天间隔 5 分钟，正好是 1440 配额)。我正在使用一个假设的 session :

session = Session(aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY, region_name=regionName)
sts = session.client('sts')
response = sts.assume_role(
    RoleArn=arn, # External role arn
    RoleSessionName='role-name',
    ExternalId='<some-id-here>',
)
tempAccessKeyId = response['Credentials']['AccessKeyId']
tempSecretAccessKey = response['Credentials']['SecretAccessKey']
tempSessionToken = response['Credentials']['SessionToken']
assumedSession = Session(
    aws_access_key_id=tempAccessKeyId,
    aws_secret_access_key=tempSecretAccessKey,
    aws_session_token=tempSessionToken,
    region_name=regionName)

在运行脚本时，我遇到了这个异常:

botocore.exceptions.ClientError: An error occurred (ExpiredToken) when calling the GetMetricStatistics operation: The security token included in the request is expired

有没有办法确保 token 在运行脚本时不会过期？我正在使用 boto3。

Answer 1

您正在使用的假设角色方法返回 临时安全凭证。以下内容摘自official documentation :

The temporary security credentials are valid for the duration that you specified when calling AssumeRole , which can be from 900 seconds (15 minutes) to 3600 seconds (1 hour). The default is 1 hour.

由于您没有使用 DurationSeconds关键字参数，返回的凭据在默认 1 小时内有效。您必须确保获得新凭据才能在 1 小时后提出请求。以下内容来自Temporary Security Credentials official documentation :

When (or even before) the temporary security credentials expire, the user can request new credentials, as long as the user requesting them still has permissions to do so.