AWS S3+跨帐户文件下载失败

Question

我在“AWS帐户1”中创建了一个名为（apple-bucket）的bucket，并允许访问另一个“AWS帐户2”以将文件上传到apple-bucket。

文件上载成功，从“AWS帐户2”到帐户1桶。

我的水桶政策是

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::******:role/role-name",
                    "arn:aws:iam::******:root"
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:ListBucketVersions",
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::apple-bucket/*",
                "arn:aws:s3:::apple-bucket"
            ]
        },
        {
            "Sid": "Access1",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::apple-bucket/*",
                "arn:aws:s3:::apple-bucket"
            ]
        }
    ]
}

注意：在命令行中，我可以使用“QA AWS凭据”下载文件，但不能使用“Prod AWS”凭据。

Answer 1

正如Michael和John所讨论的（在注释中），您可以通过复制现有对象来更正S3对象ACL，或者通过确保ACL在上传时正确设置来避免下载问题。

我最近不得不在相当大的范围内（数百万对象没有适当的ACL）解决这个问题。在不得不为所有这些对象承担就地复制的时间和费用之后，我设置了一个bucket策略，以确保上传到bucket的所有对象都必须授予bucket所有者完全控制权。

此示例策略演示如何允许特定AWS帐户在需要适当的对象ACL的情况下将对象上载到您的bucket：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AllowSourceAccount0123456789ToPutObjects",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::0123456789:root"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::apple-bucket/*"
    },
    {
        "Sid": "RequireAllUploadedObjectsToAssignFullControlToBucketOwner",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::apple-bucket/*",
        "Condition": {
            "StringNotEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    }
]
}

AWS s3 cp example-file.txt s3://apple-bucket/example-file.txt--profile aws-profile-name--acl bucket-owner-full-control