AWS：我在哪里可以看到原始访问标识列表？

Question

创建CloudFront分配时，创建了原始访问标识，以便CloudFront可以使用它来访问S3存储桶。但我在哪里看到它？我浏览了IAM链接，但找不到这种访问标识的列表。

Answer 1

Origin Access Identity不是IAM用户或角色。可以通过以下方式查看Origin Access Identities：

1. Web控制台：单击位于面板上的Origin Access Identity 您的Cloudfront信息中心左侧



1. CLI工具：运行以下命令

   aws cloudfront list-cloud-front-origin-access-identityities --output json

Answer 2

添加Origin Access Identity时，它会向S3存储桶添加策略。请查看this文档中的以下示例策略。

{
   "Version":"2012-10-17",
   "Id":"PolicyForCloudFrontPrivateContent",
   "Statement":[
     {
       "Sid":" Grant a CloudFront Origin Identity access to support private content",
       "Effect":"Allow",
       "Principal":{"CanonicalUser":"79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be"},
       "Action":"s3:GetObject",
       "Resource":"arn:aws:s3:::example-bucket/*"
     }
   ]
}

Answer 3

您可以从CloudFront控制台创建和编辑 Origin Access Identity 。

在Principal语句中指定原始访问标识的格式为：

"Principal": {"CanonicalUser": "Amazon S3 Canonical User ID"}

或者

"Principal": {"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity <ORIGIN_ACCESS_IDENTITY_ID>"}

例如：

{
    "Version": "2012-10-17",
    "Id": "Policy1476619022955",
    "Statement": [
        {
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity D3KJWPO38AQ6YV"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::static.example.com/*"
        }
    ]
}

请参阅Using an Origin Access Identity to Restrict Access to Your Amazon S3 Content。