S3存储桶策略以允许访问特定的AWS服务和用户并限制其他所有用户

Question

我有一个限制其他用户访问权限的存储桶策略。但是我想，对于aws服务，应该可以像EMR这样访问。 我发现在这里问了同样的问题： S3 Bucket Policy to Allow access to specific users and restrict all。但我也想添加服务。就像AWS服务可以访问该存储桶，但不能访问用户。

这是我的存储桶策略：

  AUser:
    Description: Name of the AUser
    Type: String             
  BUser:
    Description: Name of the BUser
    Type: String                    
Resources:    
  MetadataBucketSecurity:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: 
        Ref: MetadataBucket 
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - 
            Effect: Deny
            NotPrincipal:
              AWS:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${AUser}'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${BUser}'
            Action: 
            - 's3:ListBucket'
            - 's3:RestoreObject'
            - 's3:ReplicateObject'
            - 's3:PutObject'
            - 's3:PutBucketNotification'
            - 's3:PutBucketLogging'
            - 's3:PutObjectTagging'
            - 's3:DeleteObject'
            - 's3:GetObjectAcl'
            - 's3:GetObject'
            - 's3:GetBucketLogging'
            - 's3:GetBucketAcl'
            - 's3:ListBucketByTags'
            - 's3:GetObjectVersionAcl'
            - 's3:GetBucketPolicy'
            Resource:
              - !Sub 'arn:aws:s3:::${Bucket}'
              - !Sub 'arn:aws:s3:::${Bucket}/*'

我尝试直接添加此服务，但是没有用。

  AUser:
    Description: Name of the AUser
    Type: String             
  BUser:
    Description: Name of the BUser
    Type: String                    
Resources:    
  MetadataBucketSecurity:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: 
        Ref: MetadataBucket 
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - 
            Effect: Deny
            NotPrincipal:
              AWS:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${AUser}'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${BUser}'
              Service:
              - 'elasticmapreduce.amazonaws.com'
              - 'ec2.amazonaws.com'
            Action: 
            - 's3:ListBucket'
            - 's3:RestoreObject'
            - 's3:ReplicateObject'
            - 's3:PutObject'
            - 's3:PutBucketNotification'
            - 's3:PutBucketLogging'
            - 's3:PutObjectTagging'
            - 's3:DeleteObject'
            - 's3:GetObjectAcl'
            - 's3:GetObject'
            - 's3:GetBucketLogging'
            - 's3:GetBucketAcl'
            - 's3:ListBucketByTags'
            - 's3:GetObjectVersionAcl'
            - 's3:GetBucketPolicy'
            Resource:
              - !Sub 'arn:aws:s3:::${Bucket}'
              - !Sub 'arn:aws:s3:::${Bucket}/*'

之后，我也尝试了此操作

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::ano:root",
                    "arn:aws:iam::ano:user/AUser",
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:RestoreObject",
                "s3:ReplicateObject",
                "s3:PutBucketNotification",
                "s3:PutBucketLogging",
                "s3:PutObjectTagging",
                "s3:DeleteObject",
                "s3:GetObjectAcl",
                "s3:GetBucketLogging",
                "s3:GetBucketAcl",
                "s3:ListBucketByTags",
                "s3:GetObjectVersionAcl",
                "s3:GetBucketPolicy"
            ],
            "Resource": [
                "arn:aws:s3:::Bucket1",
                "arn:aws:s3:::Bucket1/*"
            ]
        },
        {
            "Sid": "InventoryAndAnalyticsExamplePolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "elasticmapreduce.amazonaws.com",
                    "ec2.amazonaws.com",
                    "s3.amazonaws.com"
                ]
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::Bucket1",
                "arn:aws:s3:::Bucket1/*"
            ]
        }
    ]
}

但仍然无法正常工作