Question

我尝试在 TypeScript 中通过 CDK 部署 S3 存储桶。执行代码时，即使我有管理员权限也会出错。有人知道原因吗？

export class S3Stack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const s3Example = new s3.Bucket(this, 'bucket', {
      versioned: false,
      bucketName: 'bucket',
      publicReadAccess: false,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      removalPolicy: cdk.RemovalPolicy.DESTROY
    });

    const s3ExamplePolicyDocument = {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "FirstStatement",
          "Effect": "Allow",
          "Action": [
            "s3:List*",
            "s3:Get*"
          ],
          "Resource": [
            "arn:aws:s3:::bucket",
            "arn:aws:s3:::bucket/*"
          ],
          "Principal": "*",
        }
      ]
    };

    const s3ExamplePolicy = iam.PolicyDocument.fromJson(s3ExamplePolicyDocument);

    new s3.CfnBucketPolicy(this, 'bucketpolicy', {
      bucket: s3Example.bucketName,
      policyDocument: s3ExamplePolicy
    });
  }
}

错误信息

API: s3:PutBucketPolicy Access Denied

Answer 1

我找到了解决方案。这是因为我尝试将公共权限应用于非公共存储桶。在我修改了 s3ExamplePolicyDocument 后，它工作了

AWS CDK：为什么 S3 存储桶策略发生错误

1 个答案: