Question 367923 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

Amazon web services – I cant figure out how to pull scripts from s3 to my aws workspace

Im having trouble pulling scripts from a s3 bucket to my aws workspace. I cant use access key or secret keys because they seem to be temporary and the script will be used my our support team in our org so for security reasons access keys will not be suitable. I believe the best route for this is attaching a role to my workspace to connect to s3 so I have attach a role with a policy to pull all scripts to my workspace. But for some reason Im still receiving this error.

D:Script Testnewfile3.ps1 : Failed to download file from S3: The AWS Access Key Id you provided does not
exist in our records.
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,newfile3.ps1

HERE is the script:

# Import the AWS PowerShell module 
Import-Module AWSPowerShell -Force


# Define the S3 bucket and object key 
$bucketName = "bucket-name" 
$objectKey = "new ad account/fd new ad account V4.ps1" 

# Define the local file path where you want to save the downloaded code 
$localFilePath = "D:Script Test" # Replace with your desired local file path 

# Download the code from S3 
try {
    Read-S3Object -SecretKey $secretKey -AccessKey $accessKey -Region us-west-2 -BucketName $bucketName -Key $objectKey -File $localFilePath -ErrorAction Stop
    Write-Host "File downloaded successfully from S3."
} 
catch {
    Write-Error "Failed to download file from S3: $_"
    exit 1
}

# Execute the downloaded code 
try {
    & $localFilePath
    Write-Host "Script executed successfully."
} 
catch {
    Write-Error "Failed to execute script: $_"
    exit 1
}

exit 0

HERE is the policy attached to the workspace role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        }
    ]
}

HERE is the bucket policy:

{
    "Version": "2012-10-17",
    "Id": "Policy1711030019865",
    "Statement": [
        {
            "Sid": "AllowWorkspaceToGetObject",
            "Effect": "Allow",
            "Principal": {
                "Service": "workspaces.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        }
    ]
}
Tags:

2

Answers


  1. 0

    Obtaining credentials via IAM Roles uses the Amazon EC2 Metadata Service, which is not available for Amazon Workspaces.

    The normal method of granting access would be to store IAM User credentials in a local credentials file. However, since this is a violation of your corporate policy, you would need to:

    1. Generate temporary credentials outside of the Workspace by using the aws sts assume-role or aws sts get-session-token commands
    2. Provide those credentials once logged into the Workspace by running aws configure — this will store the credentials in a local configuration file and they will only be valid for a limited time period

    This is no different to providing credentials on a personal computer, except that your policies mean you only want to use temporary credentials generated by the AWS Security Token Service (STS) instead of permanent credentials generated by AWS Identity and Access Management (IAM).

    To grant access to S3 for those credentials, you only need to add permissions to the IAM Role or IAM User that you are using. There is no need to also grant access via the Bucket Policy. Normally, a bucket policy is only used when granting public or cross-account permissions.

    Login or Signup to reply.
  2. 0 
    # Import the AWS PowerShell module
Import-Module AWSPowerShell -Force

# Define the S3 bucket and object key
$bucketName = "bucket-name"
$objectKey = "new ad account/fd new ad account V4.ps1"

# Define the local file path where you want to save the downloaded code
$localFilePath = "D:Script Testfd new ad account V4.ps1" # Replace with your desired local file path

# Download the code from S3
try {
    Read-S3Object -BucketName $bucketName -Key $objectKey -File $localFilePath -ErrorAction Stop
    Write-Host "File downloaded successfully from S3."
}
catch {
    Write-Error "Failed to download file from S3: $_"
    exit 1
}

# Execute the downloaded code
try {
    & $localFilePath
    Write-Host "Script executed successfully."
}
catch {
    Write-Error "Failed to execute script: $_"
    exit 1
}

exit 0

    Make sure that the IAM role attached to your WorkSpace has the necessary permissions to access the S3 bucket. Your policy looks good but replace "arn:aws:s3:::your-bucket-name/*" with the actual ARN and make sure the role attached to your WorkSpace has the rights.

    Also, replace "arn:aws:s3:::your-bucket-name/*" in your bucket policy.

    By default, IAM users don’t have permissions for WorkSpaces resources
    and operations. To allow IAM users to manage WorkSpaces resources, you
    must create an IAM policy that explicitly grants them permissions, and
    attach the policy to the IAM users or groups that require those
    permissions.

    To provide access, add permissions to your users, groups, or roles:

    Users and groups in AWS IAM Identity Center:

    Create a permission set. Follow the instructions in Create a
    permission set in the AWS IAM Identity Center User Guide.

    Users managed in IAM through an identity provider:

    Create a role for identity federation. Follow the instructions in
    Creating a role for a third-party identity provider (federation) in
    the IAM User Guide.

    IAM users:

    Create a role that your user can assume. Follow the instructions in
    Creating a role for an IAM user in the IAM User Guide.

    (Not recommended) Attach a policy directly to a user or add a user to
    a user group. Follow the instructions in Adding permissions to a user
    (console) in the IAM User Guide.

    For more information about IAM policies, see Policies and Permissions
    in the IAM User Guide guide.

    WorkSpaces also creates an IAM role, workspaces_DefaultRole, which
    allows the WorkSpaces service access to required resources.

    https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-access-control.html#workspaces-iam-role

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search