Question

我有一个具有以下权限的用户foo（它不是任何组的成员）：

{
  "Statement": [
    {
      "Sid": "Stmt1308813201865",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::bar"
    }
  ]
}

在我授予对经过身份验证的用户（可能适用于任何人）的完全访问权限之前，该用户似乎无法上传或执行大量操作。这仍然不允许用户更改权限，因为boto在上传后尝试执行key.set_acl('public-read')时会抛出错误。

理想情况下，此用户可以完全访问bar存储桶而无其他问题，我做错了什么？

Answer 1

您需要向存储桶本身授予 s3：ListBucket 权限。请尝试以下政策。

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "S3:*",
      "Resource": "arn:aws:s3:::bar/*",
      "Condition": {}
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::bar",
      "Condition": {}
    }
  ]
}

Answer 2

选择的答案对我不起作用，但是这个答案是：

{
  "Statement": [
    {
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ],
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "arn:aws:s3:::*"
    }
  ]
}

信用：http://mikeferrier.com/2011/10/27/granting-access-to-a-single-s3-bucket-using-amazon-iam/

Answer 3

您是否了解AWS Policy Generator？

Answer 4

Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket

上有正式的AWS文档

只需复制并粘贴相应的规则，然后在所有语句中将“资源”键更改为存储桶的ARN。

对于程序访问，该政策应为：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["s3:ListBucket"],
            "Resource": ["arn:aws:s3:::bar"]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:DeleteObject"
            ],
            "Resource": ["arn:aws:s3:::bar/*"]
        }
    ]
}

对于控制台访问，访问权限应为：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::bar*"
        },
        {
            "Effect": "Allow",
            "Action": ["s3:ListBucket"],
            "Resource": ["arn:aws:s3:::bar"]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:DeleteObject"
            ],
            "Resource": ["arn:aws:s3:::bar/*"]
        }
    ]
}

Answer 5

这对我有用：

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions"
            ],
            "Resource": "arn:aws:s3:::bucket_name_here"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*Object*",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload"
            ],
            "Resource": "arn:aws:s3:::bucket_name_here/*"
        }
    ]
}

Answer 6

如果你一直在拔头发，因为你无法弄清楚为什么Cyberduck无法设置对象ACL但是它可以与另一个客户端（如Panic Transmit）一起使用，这就是解决方案：

您需要将s3:GetBucketAcl添加到您的动作列表中，例如：

{
    "Statement": [
        {
            "Sid": "Stmt1",
            "Action": [
                "s3:GetBucketAcl",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::your-bucket-name"
        }
    ]
}

当然，如果您对s3:*的限制较少，则不需要这样做，但我认为这很有用。

Answer 7

@ cloudberryman的回答是正确的，但我喜欢让事情尽可能短。这个答案可以简化为：

{  
   "Statement":[  
      {  
         "Effect":"Allow",
         "Action":"S3:*",
         "Resource":[  
            "arn:aws:s3:::bar",
            "arn:aws:s3:::bar/*"
         ]
      }
   ]
}

Answer 8

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                        "s3:GetBucketLocation",
                        "s3:ListAllMyBuckets"
                      ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET",
                "arn:aws:s3:::YOUR-BUCKET/*"
            ]
        }
    ]
}

Answer 9

通过在资源中进行以下提及，允许存储桶内部文件夹，另外，您还应授予所有存储桶的列表权限。请查看以下示例政策

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::example-bucket",
                "arn:aws:s3:::example-bucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

要了解有关此的更多详细信息，请找到此article。

Answer 10

最近我可以使用的另一种方法是使用Amazon的documentation。对我而言，关键是将IAM用户指向特定存储桶，而不是S3控制台。按照文档“警告：您更改这些权限后，用户在访问Amazon S3主控制台时会收到“访问被拒绝”错误。主控制台链接类似于以下内容：

https://s3.console.aws.amazon.com/s3/home

相反，用户必须使用指向存储桶的直接控制台链接访问存储桶，如下所示：

https://s3.console.aws.amazon.com/s3/buckets/awsexamplebucket/“

我的政策如下：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1589486662000",
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::AWSEXAMPLEBUCKET",
            "arn:aws:s3:::AWSEXAMPLEBUCKET/*"
        ]
    }
]
}

我需要一个可以完全访问单个存储桶的Amazon S3用户

10 个答案: