如何在不列出存储桶的情况下将文件上传到Amazon S3

Question

我正在使用带有S3桶策略的Angular前端将文件上传到S3，如下所示：

{
  "Id": "Policy1499245520254",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1499245493674",
      "Action": [
        "s3:*"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::test-dev/*",
                "arn:aws:s3:::test-dev"],
      "Principal": "*"
    }
  ]
}

但如果我将上述政策更改为

{
  "Id": "Policy1499245520254",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1499245493674",
      "Action": [
        "s3:*"
      ],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::test-dev/*",
                "arn:aws:s3:::test-dev"],
      "Principal": "*"
    },
    {
      "Sid": "Stmt1499245517941",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:s3:::test-dev",
      "Principal": "*"
    }
  ]
}

在那里我添加了：

{
      "Sid": "Stmt1499245517944",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:s3:::test-dev",
      "Principal": "*"
 }

添加桶列表拒绝，上传失败。无论如何，我可以在没有列出桶的情况下上传文件。

Answer 1

这是因为s3： ListBucket操作涵盖GET Bucket（List Object）和HEAD Bucket操作。HEAD Bucket操作确定存储桶是否存在并且您有权访问它，这似乎是在对对象进行任何操作之前调用的（例如s3： PutObject操作）。请参阅在策略中指定权限。

Answer 2

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:GetObjectACL",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionAcl",
                "s3:PutObjectVersionTagging"
            ],
            "Resource": [
                "arn:aws:s3:::test-dev",
                "arn:aws:s3:::test-dev/*"
            ]
        }
    ]
}

我仅仅通过允许这些权限就解决了这个问题，显然这里不需要存储桶列表，并且解决了这个问题。