AWS S3 NotResource / Deny和资源/条件

Question

我正在尝试使用NotResource / Deny，如下所示

  "Action": [
    "s3:*"
  ],
  "NotResource": [
    "arn:aws:s3:::bucket/file.txt",
  ],
  "Effect": "Deny"
},

使用StringLike Condition for s3：ListObjectVersions如下

 {
      "Action": [
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::bucket"
      ],
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "anotherfile.txt"
          ]
        }
      },
      "Effect": "Allow"
    }

NotResource / Deny使用Condition阻止资源。有没有办法使这项工作？

Answer 1

优先权访问政策如下：

Explicit Deny > Explicit Allow > Default Deny All

使用您的设置进行映射：

Deny "NotResource" > Allow "StringLike" > Default Deny All

您可以使用以下政策允许所有其他非arn:aws:s3:::bucket/file.txt

的政策

{
      "Action": [
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::bucket/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "s3:prefix": "file.txt"
        }
      },
      "Effect": "Allow"
    }