我有一个Sping Boot 应用程序正在从EC2迁移到EKS。我在AWS中设置了一个角色和策略，该角色被附加到Pod的服务帐户。该应用程序将对象放在S3中，并为存储桶中的对象生成预签名的URL。它使用较旧的AWS SDK v1。

<dependency>
    <groupId>com.amazonaws</groupId>
    <artifactId>aws-java-sdk-s3</artifactId>
    <version>1.12.273</version>
</dependency>

字符串
并像这样设置S3Client：

AmazonS3ClientBuilder.standard()
                .withRegion(awsRegion)
                .enablePathStyleAccess()
                .enablePayloadSigning()
                .withCredentials(new InstanceProfileCredentialsProvider(true))
                .build();

型
当部署在EC2上时，策略工作并具有与S3交互的权限。但是，当部署到EKS时，我从S3获得403：

S3 failed with an error.  No link will be generated.
com.amazonaws.services.s3.model.AmazonS3Exception: Forbidden (Service: Amazon S3; Status Code: 403; Error Code: 403 Forbidden; Request ID: xxxxxxxx; S3 Extended Request ID: xxxxxxxxxxxxxxxx; Proxy: null)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1879)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleServiceErrorResponse(AmazonHttpClient.java:1418)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1387)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1157)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:814)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:781)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:755)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:715)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:697)
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:561)
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:541)
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:5456)
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:5403)
    at com.amazonaws.services.s3.AmazonS3Client.getObjectMetadata(AmazonS3Client.java:1372)
    at com.amazonaws.services.s3.AmazonS3Client.getObjectMetadata(AmazonS3Client.java:1346)
    at com.amazonaws.services.s3.AmazonS3Client.doesObjectExist(AmazonS3Client.java:1427)

型
我在AWS控制台中看到该角色没有被使用。由于Pod的服务帐户正确地具有该角色，我的假设是应用程序不能承担该角色，因此出现了403。
我假设S3ClientBuilder中的Credentials Provider需要更改。S3Client中需要什么样的Credentials Provider才能从Pod上的Service Account承担角色？这是否可能不迁移到较新的v2 SDK（仍然可以迁移，但我会遇到同样的问题吗？）