Question

我有S3静态网站托管内部网站。我找到了aws提供的策略文档，该文档将提供对公众的只读访问权限，并且我有一个策略，该策略将允许S3网站访问特定IP。当我合并时，会收到无效的政策文件错误。

        {
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "DenyPublicReadACL",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": [
                    "public-read",
                    "public-read-write",
                    "authenticated-read"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicReadGrant",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition": {
            "StringLike": {
                "s3:x-amz-grant-read": [
                    "*http://acs.amazonaws.com/groups/global/AllUsers*",
                    "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicListACL",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:PutBucketAcl",
        "Resource": "arn:aws:s3:::Examplebucket",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": [
                    "public-read",
                    "public-read-write",
                    "authenticated-read"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicListGrant",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:PutBucketAcl",
        "Resource": "arn:aws:s3:::Examplebucket",
        "Condition": {
            "StringLike": {
                "s3:x-amz-grant-read": [
                    "*http://acs.amazonaws.com/groups/global/AllUsers*",
                    "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
                ]
            }
        }
    }
]

}

    {
    "Version": "2012-10-17",
     "Id": "S3PolicyIPRestrict",
      "Statement": [
    {
        "Sid": "IPAllow",
        "Effect": "Allow",
        "Principal": {
            "AWS": "*" 
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition" : {
            "IpAddress" : {
                "aws:SourceIp": "192.168.143.0/24" 
            },
            "NotIpAddress" : {
                "aws:SourceIp": "192.168.143.188/32" 
            } 
        } 
       } 
      ]
       }

结合两个策略声明，给出无效的策略声明

Answer 1

如果您希望每个人都可以访问您的网站并通过某个IP进行完全存储桶访问，请参见以下示例：

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "PublicReadGetObject",
         "Effect": "Allow",
         "Principal": "*",
         "Action": [
            "s3:GetObject"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*"
      },
      {
         "Sid": "IPAllowFullAccess",
         "Effect": "Allow",
         "Principal": "*",
         "Action": "s3:*",
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "IpAddress": {
               "aws:SourceIp": "192.168.143.0/24"
            }
         }
      }
   ]
}

关于合并策略的问题：您不能添加两个策略，但是可以合并多个语句。一个示例只是为了展示如何组合策略：

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "DenyPublicReadACL",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "StringEquals": {
               "s3:x-amz-acl": [
                  "public-read",
                  "public-read-write",
                  "authenticated-read"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicReadGrant",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "StringLike": {
               "s3:x-amz-grant-read": [
                  "*http://acs.amazonaws.com/groups/global/AllUsers*",
                  "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicListACL",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:PutBucketAcl",
         "Resource": "arn:aws:s3:::Examplebucket",
         "Condition": {
            "StringEquals": {
               "s3:x-amz-acl": [
                  "public-read",
                  "public-read-write",
                  "authenticated-read"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicListGrant",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:PutBucketAcl",
         "Resource": "arn:aws:s3:::Examplebucket",
         "Condition": {
            "StringLike": {
               "s3:x-amz-grant-read": [
                  "*http://acs.amazonaws.com/groups/global/AllUsers*",
                  "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
               ]
            }
         }
      },
      {
         "Sid": "IPAllow",
         "Effect": "Allow",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:*",
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "IpAddress": {
               "aws:SourceIp": "192.168.143.0/24"
            },
            "NotIpAddress": {
               "aws:SourceIp": "192.168.143.188/32"
            }
         }
      }
   ]
}

结合两个s3策略用于静态网站

1 个答案: