Question

我正在尝试从ElasticBeanstalk部署的EC2实例访问我的S3存储桶之一。我的EC2实例属于 aws-elasticbeanstalk-ec2-role ，并且我已通过 AmazonS3FullAccess 策略授予此角色：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }
    ]
}

然后，存储区策略如下：

    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "eb-ad78f54a-f239-4c90-adda-49e5f56cb51e",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::elasticbeanstalk-us-east-XXXXXX/resources/environments/logs/*"
        },
        {
            "Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
            },
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX",
                "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX/resources/environments/*"
            ]
        },
        {
            "Sid": "eb-58950a8c-feb6-11e2-89e0-0800277d041b",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:DeleteBucket",
            "Resource": "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX"
        }
    ]
}

当我尝试通过SSH连接或.ebextensions中的脚本访问存储桶时，收到“拒绝访问403”错误。我尝试将文件公开并使用相同的命令，但效果很好，但我需要的文件不能公开。

我认为我对存储桶和EC2角色都有正确的策略。我可能会忘记一些细节。

任何帮助都将受到欢迎。谢谢大家！

Answer 1

因此，根据我的知识和我以前遇到的问题，您的存储桶策略不正确。这是无效的，因为必须将ListBucket和ListBucketVersions操作应用于存储桶名称，而不是前缀。

这是我应该更正的政策；

    {   
        "Version": "2008-10-17",
        "Statement": [
            {
                "Sid": "eb-ad78f54a-f239-4c90-adda-49e5f56cb51e",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
                },
                "Action": "s3:PutObject",
                "Resource": [
                    "arn:aws:s3:::elasticbeanstalk-us-east-XXXXXX/resources/environments/logs/*",
                    "arn:aws:s3:::elasticbeanstalk-us-east-XXXXXX/resources/environments/logs"
                ]
            },
            {
                "Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
                },
                "Action": [
                    "s3:GetObject",
                    "s3:GetObjectVersion"
                ],
                "Resource": [
                    "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX/resources/environments",
                    "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX/resources/environments/*"
                ]
            },
            {
                "Sid": "eb-af163bf3-d27b-4712-b795-anything",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::XXXXXX:role/aws-elasticbeanstalk-ec2-role"
                },
                "Action": [
                    "s3:ListBucket",
                    "s3:ListBucketVersions"
                ],
                "Resource": [
                    "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX"
                ]
            },
            {
                "Sid": "eb-58950a8c-feb6-11e2-89e0-0800277d041b",
                "Effect": "Deny",
                "Principal": {
                    "AWS": "*"
                },
                "Action": "s3:DeleteBucket",
                "Resource": "arn:aws:s3:::elasticbeanstalk-us-east-2-XXXXXX"
            }
        ]
    }

有用的文档，供将来参考-> AWS s3 docs

Elastic Beanstalk拒绝了AWS S3存储权限

1 个答案: