Question

我们在生产中已有一个S3存储桶策略：

{
    "Version": "2012-10-17",
    "Id": "Policy[redacted]",
    "Statement": [
        {
            "Sid": "ServiceA access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[redacted]:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::mysite-production/*"
        },
        {
            "Sid": "ServiceA access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[redacted]:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::mysite-production"
        },
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mysite-production/*"
        }
    ]
}

我们要授予访问权限的另一个第三方服务需要

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:DeleteObject"
             ],
             "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

我尝试将ListAllMyBuckets和GetBucketLocation合并到我们原始政策的最后部分，但是会产生“政策无效行为”错误：

    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "*"
        },
        "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:DeleteObject"
         ],
         "Resource": "arn:aws:s3:::mysite-production/*"
    }

如何将它们合并为一项具有凝聚力的政策？还是一个存储桶有两个策略？

谢谢！

Answer 1

您实际上可以同时应用IAM策略和S3存储桶策略同时，最终授权是所有权限中权限最小的联合。

来源：https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/

如何合并AWS S3存储桶策略？

1 个答案: