Question

我想创建一个 AWS 策略来限制对存储桶中路径的 s3:PutObject 访问。你会说容易，但是：

我需要用正则表达式设置路径 MyBucket/*/Folder1/Folder1-1/Object
这是一个跨账户访问

我尝试这样做，但它不起作用。

关于源帐户用户政策

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "",
        "Effect": "Allow",
        "Action": [
            "s3:ListBucket",
            "s3:GetBucketLocation"
        ],
        "Resource": [
            "arn:aws:s3:::MyBucket",
        ]
    },
    {
        "Sid": "",
        "Effect": "Allow",
        "Action": [
            "s3:GetObjectVersion",
            "s3:GetObject"
        ],
        "Resource": [
            "arn:aws:s3:::MyBucket/*",
        ]
    },
    {
        "Sid": "",
        "Effect": "Allow",
        "Action": "s3:PutObject",
        "Resource": [
            "arn:aws:s3:::MyBucket/*",
        ],
        "Condition": {
            "StringLike": {
                "s3:prefix": "/*/Folder1/Folder1-1/*"
            }
        }
    }
]

}

关于目标帐户存储桶策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::MyAccountID:user/MyUser"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::MyBucket",
            "Condition": {
                "StringLike": {
                    "s3:prefix": "*/Folder1/Folder1-1/*"
                }
            }
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::MyAccountID:user/MyUser"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::MyBucket/*/Folder1/Folder1-1/*"
        }
    ]
}

澄清我的桶结构：

|MyBucket
|-Client1
|-|-Folder1
|-|-|-Folder1-1
|-|-|-|-Object
|-Client1
|-|-Folder1
|-|-|-Folder1-1
|-|-|-|-Object
|-ClientXX
|-|-Folder1
|-|-|-Folder1-1
|-|-|-|-Object

我希望我的用户仅获得 PutObject 访问权限，而不是路径 Client*/Folder1/Folder1-1/，您能帮帮我吗？

Answer 1

字符串的中间不支持通配符。但是，您可以使用 IAM policy variable:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": ["s3:ListBucket"],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::mybucket"],
      "Condition": {"StringLike": {"s3:prefix": ["${aws:username}/Folder1/Folder1-1/*"]}}
    },
    {
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::mybucket/${aws:username}/Folder1/Folder1-1/*"]
    }
  ]
}

${aws:username} 变量将插入用户的用户名。这样，通配符位于字符串的末尾，这是有效的。

这是一种允许多个 IAM 用户访问同一个存储桶的常用方法，但每个用户只能访问其存储桶中的文件夹。可以在 IAM 组上创建此策略，然后可以将 IAM 组分配给每个 IAM 用户，而无需针对其特定文件夹修改它。

AWS S3 策略对正则表达式路径的限制

1 个答案: