Question

我正在尝试创建一个策略，该策略仅允许使用BackWPUp的客户的WordPress备份访问1个存储桶

这是在注意到默认的S3完全访问策略允许完全访问所有存储桶之后！

我尝试在此处关注此文章： https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket-console.html

该策略看起来像这样（将存储桶名称替换为适当的名称），但该策略不起作用：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ConsoleAccess",
            "Effect": "Allow",
            "Action": [
                "s3:GetAccountPublicAccessBlock",
                "s3:GetBucketAcl",
                "s3:GetBucketLocation",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketPublicAccessBlock",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ListObjectsInBucket",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": ["arn:aws:s3:::bucket-name"]
        },
        {
            "Sid": "AllObjectActions",
            "Effect": "Allow",
            "Action": "s3:*Object",
            "Resource": ["arn:aws:s3:::bucket-name/*"]
        }
    ]
}

接收错误： S3服务API：访问被拒绝

然后，我尝试了一个简化版本：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PolicyID",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ]
}

仍然没有运气，但有同样的错误。有任何想法吗？我想念什么？

Answer 1

结果证明，我需要 s3：ListBucketMultipartUploads 和 s3：GetBucketLocation 才能使其正常工作。

下面的最终版本：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": "arn:aws:s3:::bucket-name"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*"
            "Resource": "arn:aws:s3:::bucket-name/*"
        }
    ]
}

创建仅1个S3存储桶的AWS访问策略

1 个答案: