Question

创建C＃应用程序，以查看存储在AWS S3中的文件夹和文件，以便注册到我的站点的客户端。

目前，我可以创建IAM用户并将其权限分配给特定文件夹。但是当我试图查看文件夹及其内容时遇到了问题。如果我使用AWS访问密钥和密钥，我可以查看该文件夹，但是想知道是否有用户级凭据可以用来检索用户被授予的文件夹？

这是我到目前为止所得到的。

            Policy pl = GeneratePolicy(bucketName, foldername);
            Credentials creds = GetFederatedCredentials(pl, username);


            var sessionCredentials = new SessionAWSCredentials(creds.AccessKeyId, creds.SecretAccessKey, creds.SessionToken);

            using (var client = new AmazonS3Client(sessionCredentials, Amazon.RegionEndpoint.USEast1))
            {
                var response = client.ListObjects(request);

                foreach (var subFolder in response.CommonPrefixes)
                {
                    /* list the sub-folders */

                    Console.WriteLine(subFolder);
                }
                foreach (var file in response.S3Objects)
                {
                    /* list the files */
                }
            }

但在client.ListObjects（请求）上获取错误 - 访问被拒绝错误

这是GeneratePolicy代码

public static Policy GeneratePolicy(string bucket, string username)
    {
        var statement = new Statement(Statement.StatementEffect.Allow);

        // Allow access to the sub folder represented by the username in the bucket
        statement.Resources.Add(ResourceFactory.NewS3ObjectResource(bucket, username + "/*"));

        // Allow Get and Put object requests.
        statement.Actions = new List<ActionIdentifier>() { S3ActionIdentifiers.GetObject, S3ActionIdentifiers.PutObject };

        // Lock the requests coming from the client machine.
        //statement.Conditions.Add(ConditionFactory.NewIpAddressCondition(ipAddress));

        var policy = new Policy();
        policy.Statements.Add(statement);

        return policy;
    }

以下是GetFederatedCredentials代码

public static Credentials GetFederatedCredentials(Policy policy, string username)
    {
        var request = new GetFederationTokenRequest()
        {
            Name = username,
            Policy = policy.ToJson()
        };

        var stsClient = new AmazonSecurityTokenServiceClient(AWS_ACCESS_KEY, AWS_SECRET_KEY, Amazon.RegionEndpoint.USEast1);

        var response = stsClient.GetFederationToken(request);
        return response.GetFederationTokenResult.Credentials;
    }

非常感谢任何帮助。提前致谢

Answer 1

您应该将“ListBucket”添加到statement.Actions

适用于S3的AWS List用户文件夹

1 个答案: