AccessDenied：用户无权执行：cloudfront:CreateInvalidation

我正在尝试使用 ember-cli-deploy 和 ember-cli-deploy-cloudfront 将 ember 应用程序部署到 AWS CloudFront。

我在 AWS 中设置了存储桶和用户，并为我的用户提供了 AmazonS3FullAccess 策略。

设置我的.env.deploy.production文件看起来像这样：

AWS_KEY=<my key>
AWS_SECRET=<my secret>
PRODUCTION_BUCKET=<app.<my domain>.com
PRODUCTION_REGION=us-east-1
PRODUCTION_DISTRIBUTION=<my cloudfront distribution id>

My config/default.js看起来像这样：

/* jshint node: true */

module.exports = function(deployTarget) {
  var ENV = {
    build: {},
    pipeline: {
      activateOnDeploy: true
    },
    s3: {
      accessKeyId: process.env.AWS_KEY,
      secretAccessKey: process.env.AWS_SECRET,
      filePattern: "*"
    },
    cloudfront: {
      accessKeyId: process.env.AWS_KEY,
      secretAccessKey: process.env.AWS_SECRET
    }
  };

  if (deployTarget === 'staging') {
    ENV.build.environment = 'production';
    ENV.s3.bucket = process.env.STAGING_BUCKET;
    ENV.s3.region = process.env.STAGING_REGION;
    ENV.cloudfront.distribution = process.env.STAGING_DISTRIBUTION;
  }

  if (deployTarget === 'production') {
    ENV.build.environment = 'production';
    ENV.s3.bucket = process.env.PRODUCTION_BUCKET;
    ENV.s3.region = process.env.PRODUCTION_REGION;
    ENV.cloudfront.distribution = process.env.PRODUCTION_DISTRIBUTION;
  }

  return ENV;
};

我安装了ember-cli-deploy, ember-cli-deploy-cloudfront and ember install ember-cli-deploy-aws-pack.

当我跑步时ember deploy production

我收到此错误：

AccessDenied: User: arn:aws:iam::299188948670:user/Flybrary is not authorized to perform: cloudfront:CreateInvalidation

我的理解是ember-cli-deploy-cloudfront为您处理创建失效，但是当我看到此错误时，我进入 AWS IAM 控制台并自己创建了失效。当我尝试运行时仍然遇到相同的错误ember deploy production.

IAM 策略不允许限制对特定 CloudFront 分配的访问。解决方法是对资源使用通配符，而不是仅引用特定的 CloudFront 资源。将其添加到您的 IAM 策略将解决您遇到的问题。

以下是有效 IAM 策略中的示例：

{
  "Statement": [  
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudfront:CreateInvalidation",
        "cloudfront:GetInvalidation",
        "cloudfront:ListInvalidations"
      ],
      "Resource": "*"
    }
  ]
}

Docs:

• 与 IAM 配合使用的 AWS 服务 http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html
• CloudFront API 权限 http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html
• 对 CloudFront 使用基于身份的策略（IAM 策略） http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/access-control-managing-permissions.html