Question

我试图按角色限制用户只访问S3存储桶中的特定文件夹。该存储桶配置为＆＃34;模拟可安装＆＃34;可以这么说，我们可以将它用于文件共享，就好像它是一个更传统的服务器。每个用户都使用CloudBerry远程访问S3。

这是我当前（破损）的政策，而水桶名称是＆＃34; bluebolt＆＃34;。

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AllowUserToSeeBucketListInTheConsole",
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListAllMyBuckets"
        ],
        "Resource": [
            "arn:aws:s3:::*"
        ]
    },
    {
        "Sid": "AllowRootAndHomeListingOfCompanySharedAndPAndP",
        "Effect": "Allow",
        "Action": [
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bluebolt"
        ],
        "Condition": {
            "StringEquals": {
                "s3:prefix": [
                    "",
                    "Production and Processing/",
                    "Production and Processing/${aws:username}",
                    "Company Shared/"
                ],
                "s3:delimiter": [
                    "/"
                ]
            }
        }
    },
    {
        "Sid": "AllowListingOfCompanyShared",
        "Effect": "Allow",
        "Action": [
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bluebolt"
        ],
        "Condition": {
            "StringLike": {
                "s3:prefix": [
                    "Company Shared/*"
                ]
            }
        }
    },
    {
        "Sid": "AllowListingOfUserFolder",
        "Effect": "Allow",
        "Action": [
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bluebolt"
        ],
        "Condition": {
            "StringLike": {
                "s3:prefix": [
                    "Production and Processing/${aws:username}/",
                    "Production and Processing/${aws:username}/*"
                ]
            }
        }
    },
    {
        "Sid": "AllowAllS3ActionsCompanyShared",
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::bluebolt/Company Shared/*"
        ]
    },
    {
        "Sid": "AllowAllS3ActionsInUserFolder",
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::bluebolt/Production and Processing/${aws:username}/*"
        ]
    },
    {
        "Sid": "DenyAllS3ActionsInManagement",
        "Effect": "Deny",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::bluebolt/Management/*"
        ]
    }
]

}

所以，我想要做的是限制用户列出/读/写只有＆＃34; /生产和处理/ [用户名]＆＃34;中的内容，以及能够列出/读取所有内容in＆＃34; /公司共享＆＃34;同时明确禁止所有访问＆＃34; /管理＆＃34;以及＆＃34; /生产和加工/ *＆＃34;除了他们的用户文件夹理想情况下，用户只能看到＆＃34; /公司共享＆＃34;和＆＃34; /生产和加工＆＃34;在bluebolt中，一旦他们进入＆＃34; /生产和处理＆＃34;，他们只能看到他们用户命名的文件夹，这是他们的工作区。

现在，一旦他们挖掘蓝线顶级存储桶，我就会被用户偶尔访问（＆＃34;您无权访问＆＃34;）。

我不知道这个用例是否常见，或者我是否试图将一个钉子放入一个圆孔中，但欢迎任何反馈/提示/类似政策应用/严厉批评非常感谢！

Answer 1

IAM policy variables with federated users

$ {aws：userName}策略变量不适用于角色。使用$ {aws：userID}策略变量而不是$ {aws：userName}策略变量。

$ {aws：userid}变量将是＆＃34; ROLEID：caller-specified-name＆＃34;。

我使用与aws:userid相同的政策和角色。

获取角色ID。

iam get-role --role-name Arsenal-role --query Role.RoleId
AROAXXT2NJT7D3SIQN7Z6

要求您的用户上传到Bucket/Prefix/<RoleID:SessionName>/

aws s3 cp test.txt 's3://mydemo/Production and Processing/AROAXXT2NJT7D3SIQN7Z6:john/' --profile s3role
upload: ./test.txt to s3://mydemo/Production and Processing/AROAXX2NJT7D3SIQN7Z6:john/test.txt

aws s3 cp test.txt 's3://mydemo/Management/' --profile s3role
upload failed: ./test.txt to s3://mydemo/Management/test.txt An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

aws s3 cp test.txt 's3://mydemo/Production and Processing/' --profile s3role
upload failed: ./test.txt to s3://mydemo/Production and Processing An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

Answer 2

这是我开始工作的代码。

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AllowListingOfUserFolder",
        "Action": [
            "s3:ListBucket"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::bluebolt"
        ],
        "Condition": {
            "StringLike": {
                "s3:prefix": [
                    "*",
                    "bluebolt/Company Shared/*",
                    "bluebolt/Production and Processing/*",
                    "bluebolt/Production and Processing/${aws:userName}/*"
                ]
            }
        }
    },
    {
        "Sid": "AllowAllS3ActionsInUserFolder",
        "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:GetObjectVersion",
            "s3:DeleteObject"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::bluebolt/Production and Processing/${aws:userName}/*"
        ]
    },
    {
        "Sid": "AllowCertainS3ActionsInCompanyShared",
        "Action": [
            "s3:GetObject",
            "s3:GetObjectVersion"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::bluebolt/Company Shared/*"
        ]
    }
]

}

AWS IAM策略：限制用户/角色的存储桶/文件夹访问？

2 个答案: