AWS IAM存储桶权限访问被拒绝

Question

有没有人遇到过这样的情况：当我对一个用户使用管理策略时，它可以工作，但当我使用内联策略时，它说访问被拒绝。我为IAM用户授予了对bucket读取访问权限，即它只能访问bucket。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:Get*",
                "s3:List*"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:Get*",
                "s3:List*"
            ],
            "Resource": "arn:aws:s3:::mybucketname/*"
        }
    ]
}

我也试过这个

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3Permissions",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::mybucketname/*",
        "arn:aws:s3:::mybucketname"
      ]
    }
  ]
}

Answer 1

您的最后一个策略应该可以直接访问bucket，如：

• 如何只授予用户AmazonS3控制台对某个存储桶或文件夹的访问权限？

对于控制台访问，需要附加权限，如：

null

具体来说，策略应该像：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::test"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": ["arn:aws:s3:::test/*"]
    }
  ]
}

Amazons3ReadOnlyAccess具有上述所有权限，而您的内联策略没有。