使用IAM角色,脚本可以在AWS cli中工作,但不能在AWS Tools for powershell中工作

这是一个非常奇怪的问题,我不知道如何回答。

因此,我们有一个脚本,它列出了与该框相关联的安全组-用powershell编写:

$ErrorActionPreference = "Stop"

if ($boxName -eq $NULL)
{
    Write-Host "Box name wasn't specified!"
    Exit 1    
}

if ($region -eq $NULL)
{
   $region = "eu-west-1"
}

Set-DefaultAWSRegion -Region $region

$searchFor =@(
    @{
        name = 'tag:Name'
        values = $boxName
    }
)
$SecurityGrp = Get-EC2SecurityGroup -Filter $searchFor

Write-Host $SecurityGrp.GroupName

function DisplayIPPermissions {
    param (
        $Permission
    )

    Write-Host "`nSecurity Group Name $($Permission.GroupName)"
    Write-Host "Security Group ID $($Permission.GroupId)"
    Write-Host "Protocol $($Permission.IpProtocol)"
    Write-Host "FromPort: $($Permission.FromPort)"
    Write-Host "ToPort: $($Permission.ToPort)"

    Write-Host "IPv4 Ranges";
    foreach($iprange in $Permission.Ipv4Ranges)
    {
        Write-Host $iprange.CidrIp
    }

    Write-Host "UserGroupIdPairs"

    foreach($pair in $Permission.UserGroupIdPairs)
    {
        Write-Host $pair.GroupId
    }
}


Write-Host "`n`nInBound`n`n"

foreach($rule in $SecurityGrp.IPPermissions)
{
    DisplayIPPermissions $rule
}

Write-Host "`n`nOutBound`n`n"
foreach($rule in $SecurityGrp.IPPermissionsEgress)
{
    DisplayIPPermissions $rule
}

当使用在我的本地机器上运行的IAM访问密钥时,这非常有效。它返回安全组的详细信息,包括名称、id、端口和用户组对。

然而,当我在附加了IAM角色的实例EC2上运行此操作时,我会得到一些非常奇怪的行为。脚本运行时没有任何错误,但除了端口之外,所有值都有空字符串。输出示例:

InBound



Security Group Name 
Security Group ID 
Protocol tcp
FromPort: 3579
ToPort: 3579
IPv4 Ranges
UserGroupIdPairs

Security Group Name 
Security Group ID 
Protocol tcp
FromPort: 22
ToPort: 22
IPv4 Ranges
UserGroupIdPairs

Security Group Name 
Security Group ID 
Protocol tcp
FromPort: 443
ToPort: 443
IPv4 Ranges
UserGroupIdPairs


OutBound



Security Group Name 
Security Group ID 
Protocol tcp
FromPort: 3579
ToPort: 3579
IPv4 Ranges
UserGroupIdPairs

Security Group Name 
Security Group ID 
Protocol -1
FromPort: 0
ToPort: 0
IPv4 Ranges
UserGroupIdPairs

Security Group Name 
Security Group ID 
Protocol tcp
FromPort: 443
ToPort: 443
IPv4 Ranges
UserGroupIdPairs

这完全令人困惑,因为出于某种原因,代码显然在遍历规则并正确地获取端口。我不明白为什么港口被区别对待。

更奇怪的是这个命令: aws ec2 describe-security-groups --filters "Name=tag:Name,Values=$boxName"

完美地使用IAM角色。

为什么会发生这种情况?