Question

我正在尝试为特定用户定义策略。我的S3中有几个存储桶，但我想让用户访问其中一些存储桶。我创建了以下政策：

{
  "Version":"2012-10-17",
  "Statement":[
  {
  "Sid":"AddPerm",
  "Effect":"Allow",
  "Principal": "*",
  "Action":["s3:GetObject",
            "s3:ListBucket",
            "s3:ListAllMyBuckets",
            "s3:GetBucketLocation",
            "s3:PutObject"],
  "Resource":["arn:aws:s3:::examplebucket"]
}

当我尝试添加这样的资源列表时：

"Resource":["arn:aws:s3:::examplebucket1","arn:aws:s3:::examplebucket2"]

我被拒绝访问

对我有用的唯一选项（我得到存储桶列表）是：

"Resource": ["arn:aws:s3:::*"]

问题是什么？

Answer 1

某些Amazon S3 API调用在 Bucket 级别运行，而有些则在对象级别运行。因此，您需要一个如下政策：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::test"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": ["arn:aws:s3:::test/*"]
    }
  ]
}

请参阅：AWS安全博客 - Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket

Answer 2

我发现它是AWS的限制。没有选项获取过滤桶列表。一旦你给ListAllMyBuckets这样的权限：

{
  "Sid": "AllowUserToSeeBucketListInTheConsole",
  "Action": ["s3:GetBucketLocation", "s3:ListAllMyBuckets"],
  "Effect": "Allow",
  "Resource": ["arn:aws:s3:::*"]

}

您将获得所有存储桶的列表（包括您没有权限的存储桶）。

可在此处找到更多信息：https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/

这里可以找到很少的解决方法：Is there an S3 policy for limiting access to only see/access one bucket?

亚马逊s3用户政策

2 个答案: