Question

根据此政策：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "s3:ListStorageLensConfigurations",
            "s3:ListAccessPointsForObjectLambda",
            "s3:GetAccessPoint",
            "s3:PutAccountPublicAccessBlock",
            "s3:GetAccountPublicAccessBlock",
            "s3:ListAllMyBuckets",
            "s3:ListAccessPoints",
            "s3:ListJobs",
            "s3:PutStorageLensConfiguration",
            "s3:CreateJob"
        ],
        "Resource": "*"
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "*"
    }
]

}

我被允许访问特定的 s3 接入点。但是，当我尝试使用更具体的访问权限时，该访问权限只为特定访问点提供 s3:* 操作：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "s3:ListStorageLensConfigurations",
            "s3:ListAccessPointsForObjectLambda",
            "s3:GetAccessPoint",
            "s3:PutAccountPublicAccessBlock",
            "s3:GetAccountPublicAccessBlock",
            "s3:ListAllMyBuckets",
            "s3:ListAccessPoints",
            "s3:ListJobs",
            "s3:PutStorageLensConfiguration",
            "s3:CreateJob"
        ],
        "Resource": "*"
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "arn:aws:s3:eu-west-1:598276570227:accesspoint/accesspointname"
    }
]

}

这不起作用，并且具有此角色的 EC2 无法访问 s3 访问点（仅使用 AWS CLI 复制文件）

首先为什么会这样？根据我的判断，该角色仍然应该有权访问该接入点上的所有操作（这在某种程度上肯定是错误的！）。

其次，我试图使 s3 存储桶只能从某个 IAM 角色访问。我尝试从接入点本身的访问策略中设置它。这有相反的问题，它过于宽松，一切仍然可以访问它。执行此操作的正确方法是什么 - 在访问点上放置 IAM 策略以限制对 IAM 角色的访问或创建一个可以访问此 s3 访问点的 IAM 角色？

Answer 1

我通过使用它来完成这项工作：]

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "s3:ListStorageLensConfigurations",
            "s3:ListAccessPointsForObjectLambda",
            "s3:GetAccessPoint",
            "s3:PutAccountPublicAccessBlock",
            "s3:GetAccountPublicAccessBlock",
            "s3:ListAllMyBuckets",
            "s3:ListAccessPoints",
            "s3:ListJobs",
            "s3:PutStorageLensConfiguration",
            "s3:CreateJob"
        ],
        "Resource": "*"
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "*",
        "Condition": {
            "StringLike": {
                "s3:DataAccessPointArn": "arn:aws:s3:eu-west-1:598276570227:accesspoint/accesspointname"
            }
        }
    }
]

}

IAM 策略未授予访问接入点的权限

1 个答案: