Warm tip: This article is reproduced from serverfault.com, please click

python-当以daemon.service运行时,Botocore无法读取凭据

(python - Botocore fails to read credentials when run as daemon.service)

发布于 2018-04-01 23:47:21

我的脚本从命令行顺利运行,但是,当我将其作为systemd.service启动时,出现以下错误:

iot_local.service - My iot_local Service
   Loaded: loaded (/lib/systemd/system/iot_local.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sun 2018-04-01 23:06:45 UTC; 5s ago
  Process: 2436 ExecStart=/usr/bin/python /home/ubuntu/myTemp/iot_local.py (code=exited, status=1/FAILURE)
 Main PID: 2436 (code=exited, status=1/FAILURE)

Apr 01 23:06:45 ip-172-31-29-45 python[2436]:   File "/usr/local/lib/python2.7/dist-packages/botocore/client.py", line 358, in resolve
Apr 01 23:06:45 ip-172-31-29-45 python[2436]:     service_name, region_name)
Apr 01 23:06:45 ip-172-31-29-45 python[2436]:   File "/usr/local/lib/python2.7/dist-packages/botocore/regions.py", line 122, in construct_endpoint
Apr 01 23:06:45 ip-172-31-29-45 python[2436]:     partition, service_name, region_name)
Apr 01 23:06:45 ip-172-31-29-45 python[2436]:   File "/usr/local/lib/python2.7/dist-packages/botocore/regions.py", line 135, in _endpoint_for_partition
Apr 01 23:06:45 ip-172-31-29-45 python[2436]:     raise NoRegionError()
Apr 01 23:06:45 ip-172-31-29-45 python[2436]: botocore.exceptions.NoRegionError: You must specify a region.
Apr 01 23:06:45 ip-172-31-29-45 systemd[1]: iot_local.service: Main process exited, code=exited, status=1/FAILURE
Apr 01 23:06:45 ip-172-31-29-45 systemd[1]: iot_local.service: Unit entered failed state.
Apr 01 23:06:45 ip-172-31-29-45 systemd[1]: iot_local.service: Failed with result 'exit-code'.

在这条线上似乎失败了:

DB=boto3.resourse('dynamodb')

如果我将区域添加为参数,则脚本稍后仍会失败,因为找不到凭据。因此,当我提供region,id和key作为参数时,一切正常:

boto3.resource('dynamodb', region_name='us-west-2', aws_access_key_id=ACCESS_ID, aws_secret_access_key=ACCESS_KEY)

明显的问题是,当此脚本作为服务运行时,它无法从~/.aws/config获取信息~/.aws/credentials,我确保通过aws configure此处所述运行来包含所有必需的信息

[default]
aws_access_key_id=XXXXXXXXXXXXXX
aws_secret_access_key=YYYYYYYYYYYYYYYYYYYYYYYYYYY

我也尝试过这个:

export AWS_CONFIG_FILE="/home/ubuntu/.aws/config"

和这个

sudo chown root:root ~/.aws

但这没有帮助。为什么.service无法“看到”凭据文件的任何想法?

Questioner
Nazar
Viewed
11
jarmod 2018-04-07 07:34:31

当systemd将脚本作为服务运行时,ubuntu用户将不再运行该脚本,因此主目录不再是/ home / ubuntu。这意味着〜/ .aws / credentials不再引用/home/ubuntu/.aws/credentials,因此你的脚本正在尝试从错误的位置加载凭据(可能是/root/.aws/credentials)。

你可以配置systemd以特定用户身份运行脚本User=ubuntu在该[Service]部分中添加