AWS S3 ListMultipartUploads:访问被拒绝

时间:2017-07-19 07:18:06

标签: c# amazon-web-services amazon-s3 aws-sdk aws-sdk-net

我已关注this blog以使用Web Identity Federation设置我的AWS IAM和S3帐户。我能够验证和接收会话凭证和令牌都很好。我也可以下载和上传对象。但是,我得到了:

  

访问被拒绝

在以下ListMultipartUploads请求中:

var request = new ListMultipartUploadsRequest()
{
    BucketName = bucketName,
    Prefix = $"{UserId}/"
};

var response = await s3Client.ListMultipartUploadsAsync(request);

我的IAM角色附带的访问策略是:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::mybucket/${myidentityprovider:userId}/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": "${myidentityprovider:userId}/"
                }
            }
        }
    ]
}

如您所见,我拥有权限" s3:ListBucketMultipartUploads",因此用户应该能够在其存储桶上执行ListMultiPartUploads。我做错了什么?

1 个答案:

答案 0 :(得分:0)

我在前缀语句中看到错误,

它必须是一个数组,

  

" s3:前缀":[" $ {myidentityprovider:userId} / *"]

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:AbortMultipartUpload",
            "s3:DeleteObject",
            "s3:GetObject",
            "s3:PutObject"
        ],
        "Resource": "arn:aws:s3:::mybucket/${myidentityprovider:userId}/*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListBucket",
            "s3:ListBucketMultipartUploads"
        ],
        "Resource": [
            "arn:aws:s3:::mybucket"
        ],
        "Condition": {
            "StringLike": {
                "s3:prefix": ["${myidentityprovider:userId}/*"]
            }
        }
    }
]}