AWS AssumeRole授权不起作用

我试图在我的PHP程序中使用AWS sts调用AssumeRole函数，因为我想创建临时凭证以允许用户为AWS存储桶创建对象.

I am attempting to call the AssumeRole function using AWS sts in my PHP program since I want to create temporary credentials to allow a user to create an object for an AWS bucket.

以下是我所说的PHP的功能:

Below is the fumction I am calling PHP:

  $sts = StsClient::factory(array(
                'key'    => 'XXXXXXXXXXXXXX',
                'secret' => 'XXXXXXXXXXXXXXXX',
                'token.ttd' => $timetodie
            ));             
  $bucket = "mybucket";             
            $result1 = $sts->assumeRole(array(          
                'RoleArn' => 'arn:aws:iam::123456789012:role/createPic',
                'RoleSessionName' => 'mytest',
                'Policy' => json_encode(array(
                        'Statement' => array(
                             array(
                                  'Sid' => 'Deny attributes',
                                  'Action' => array(
                                  's3:deleteObject', 
                                  's3:deleteBucket'
                                  ),
                                  'Effect' => 'Deny',
                                  'Resource' => array(
                                  "arn:aws:s3:::{$bucket}",
                                  "arn:aws:s3:::{$bucket}/AWSLogs/*"
                                  ),
                                  'Principal' => array(
                                  'AWS' =>   "*"
                                  )
                              ) 
                          )
                      )
                  ),
                'DurationSeconds' => 3600,
             //   'ExternalId' => 'string',
            ));

            $credentials  = $result1->get('Credentials');

但是，我不断收到以下错误消息:

However, I keep getting the following error:

用户arn:aws:iam :: 123456789012:user/TVM用户无权执行:资源上的sts:AssumeRole:arn:aws:iam :: 123456789012:role/createPic

User arn:aws:iam::123456789012:user/TVMUser is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/createPic

以下是我在AWS控制台上对用户TVMUser的权限策略:

Below is my permissions policy for user TVMUser on my AWS console:

      {
  "Version": "2012-10-17",
 "Statement": [
 {
  "Effect":"Allow",
  "Action":"ec2:RunInstances",
  "Resource":"*"
 },
 {
  "Effect":"Allow",
  "Action":"iam:PassRole",
  "Resource":"arn:aws:iam::791758789361:user/TVMUser"

 },

 {
  "Effect":"Allow",
  "Action":"sts:AssumeRole",
  "Resource":"arn:aws:iam::791758789361:role/createPic"

 }
]
}

以下是我的角色createPic的角色策略:

Below is my role policy for the role createPic:

       {
  "Version": "2012-10-17",
 "Statement": [
 {
  "Action": [

    "s3:Get*",
    "s3:List*",
    "s3:Put*",

  ],
  "Effect": "Allow",
  "Resource": "*"
  },
{
  "Effect": "Allow",

  "Action": "sts:AssumeRole",
  "Resource":  "arn:aws:iam::123456789012:role/createPic"
}
]
}

现在有人在AWS策略声明和AWS上设置中缺少我的信息了吗，所以我没有收到错误:用户arn:aws:iam :: 123456789012:user/TVMUser无权执行:sts:AssumeRole关于资源:arn:aws:iam :: 123456789012:role/createPic?

Does anyone now what I am missing in my AWS policy statements and setup on AWS so I don't get the error: User arn:aws:iam::123456789012:user/TVMUser is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/createPic?

我想念什么吗?