Question

我试图在我的serverless.yml文件中添加一个S3存储桶策略，该策略将授予我在存储桶上创建权限的IAM用户。

我首先直接在控制台中的不同阶段（开发）中将策略添加到存储桶中，现在我试图在不同阶段（测试）中在无服务器中复制该策略。

但是，即使我遵循aws documentation，也似乎不太正确。以下是我的serverless.yml文件中的策略。为了减少潜在的错误，我直接复制了我的主体和资源。

    S3CredentialsBucket:
      Type: 'AWS::S3::Bucket'
    BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties:
        Bucket: !Ref S3CredentialsBucket
        PolicyDocument:
          Id: ProdAnsiblePolicy
          Version: "2012-10-17"
          Statement:
            -
              Effect: Allow
              Principal: 'arn:aws:iam::***********:user/prodAnsible'
              Action: 's3:*'
              Resource: 'arn:aws:s3:::test-mr-2-current-tenant-configurations'

这里是我直接在控制台中添加到存储桶的策略的工作原理-这意味着用户可以将对象放入存储桶。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::***********:user/prodAnsible"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::dev-2-current-tenant-configurations"
        },
        {
            "Sid": "statement2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::***********:user/prodAnsible"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::dev-2-current-tenant-configurations/*"
        }
    ]
}

一切正常，尝试部署时出现以下错误："An error occurred: BucketPolicy - Invalid policy syntax."。任何帮助将不胜感激！

最后，这是无服务器文件cloudformation-template-update-stack.json。

    "S3TenantConfigBucket": {
      "Type": "AWS::S3::Bucket"
    },
    "BucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "S3TenantConfigBucket"
        },
        "PolicyDocument": {
          "Id": "ProdAnsiblePolicy",
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::249161078948:user/prodAnsible"
              },
              "Action": "s3:*",
              "Resource": "arn:aws:s3:::test-mr-2-current-tenant-configurations/*"
            }
          ]
        }
      }
    }
  }

还值得注意的是，存储桶是如何创建的：

    events:
      - s3:
          bucket: ${self:custom.s3_bucket}
          event: s3:ObjectCreated:*

根据serverless docs，这是一种事件驱动的方法预先感谢！

Answer 1

如果您指定的原则是IAM用户，则需要将其添加为AWS密钥的值。参考：AWS JSON Policy Elements: Principal

    S3CredentialsBucket:
      Type: 'AWS::S3::Bucket'
    BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties:
        Bucket: !Ref S3CredentialsBucket
        PolicyDocument:
          Id: ProdAnsiblePolicy
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                AWS: 'arn:aws:iam::***********:user/prodAnsible'
              Action: 's3:*'
              Resource: 'arn:aws:s3:::test-mr-2-current-tenant-configurations'

在无服务器的环境中创建S3存储桶策略-发生错误：BucketPolicy-策略语法无效

1 个答案: