代码之家 › 专栏 › 技术社区 › DenCowboy

AWS S3 Bucket策略

amazon-cloudformation amazon-s3 amazon-web-services

DenCowboy · 技术社区 · 8 年前

我创建了一个包含cloudformation的bucket:

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  BucketName:  
    Type: String
    Description: "Choose a name for the S3 Bucket"
    Default: "myrandomnameforbucket"
  S3Bucket:
    Type: "AWS::S3::Bucket"
    Properties:
      AccessControl: "Private"
      BucketName: !Ref BucketName

现在我正在写一份巴克特政策,但我面临一些问题。我想要实现的目标:

用户A(UserA)可以上传到S3
用户A(UserA)无法从S3中删除
所有用户(在我的环境中,不是公共用户)都可以读取S3
所有用户(在我的环境中,nob public)都可以从S3中删除

我怎样才能做到这一点? 目前,我拒绝了userA的删除,并允许userA上传。

          - Effect: Deny
            Principal:
              AWS: 
                !GetAtt UserA.Arn
            Action: "s3:DeleteObject"
            Resource: 
              Fn::Join:  ["", ["arn:aws:s3:::", Ref: "S3Bucket", "/*"]]
          - Effect: Allow
            Principal:
              AWS: 
                !GetAtt UserA.Arn
            Action: "s3:PutObject"
            Resource: 
              Fn::Join:  ["", ["arn:aws:s3:::", Ref: "S3Bucket", "/*"]]
          - Effect: Allow
            Principal: "?" # * is public?
            Action: s3:GetObject
            Resource: 
              Fn::Join:  ["", ["arn:aws:s3:::", Ref: "S3Bucket", "/*"]]

2 回复 | 直到 8 年前

hansaplast 8 年前

我知道有两个问题:

如何在排除匿名用户时授予所有IAM用户访问权限
如何限制一个用户多于其他用户,即:删除您刚刚授予其他用户的权限

第一个问题一开始听起来很简单 the documentation states :

在基于资源的策略中,使用Principal元素指定允许访问资源的帐户或用户

这意味着你可以做一些类似的事情:

Principal:
    AWS: !Ref "AWS::AccountId"

但当我尝试时,它就是不起作用。当设置特定用户的arn时,它对我很有用。这对我来说似乎是个错误。或文件不明确。有 this other report I found 。

不管怎样,你能做的就是 Principal: AWS: "*" 然后使用 Condition 到 restrict to IAM users only 。

第二个问题要容易得多:对政策进行评估时,要明确 deny s优先于一般 allow s see documentation 。

由此产生的政策可以这样写:

S3Policy:
  Type: "AWS::S3::BucketPolicy"
  Properties:
    Bucket: !Ref S3Bucket
    PolicyDocument:
      Statement:
        - Effect: Deny
          Action: "s3:DeleteObject"
          Resource: !Join ["", ["arn:aws:s3:::", Ref: "S3Bucket", "/*"]]
          Principal:
            AWS: !GetAtt UserA.Arn
        - Effect: Allow
          Action: "s3:PutObject"
          Resource: !Join ["", ["arn:aws:s3:::", Ref: "S3Bucket", "/*"]]
          Principal:
            AWS: !GetAtt UserA.Arn
        - Effect: Allow
          Action: ["s3:GetObject", "s3:DeleteObject"]
          Resource: !Join ["", ["arn:aws:s3:::", Ref: "S3Bucket", "/*"]]
          Principal:
            AWS: "*"
          Condition:
            StringEquals:
              "aws:PrincipalType": ["User"]

marcincuber 8 年前

  {
"Version": "2012-10-17",
"Id": "S3PolicyId1",
"Statement": [
    {
        "Sid": "AllowGet",
        "Effect": "Allow",
        "Principal":{"AWS":"arn:aws:iam::account-number-without-hyphens:user/user1"},
        "Action": [
            "s3:Get*",
            "s3:List*"
        ],
        "Resource": [
            "arn:aws:s3:::s3_bucket_name",
            "arn:aws:s3:::s3_bucket_name/*"
        ]
    },
    {
        "Sid": "DenyDeleteObject",
        "Effect": "Deny",
        "Principal": {"AWS":"arn:aws:iam::account-number-without-hyphens:user/user1"},
        "Action": "s3:Delete*",
        "Resource": [
            "arn:aws:s3:::s3_bucket_name",
            "arn:aws:s3:::s3_bucket_name/*"
        ]
    },
    {
        "Sid": "Allow anyone in your account to access bucket",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::account-number-without-hyphens:root"
        },
        "Action": [
            "s3:Get*",
            "s3:List*",
            "s3:Put*",
            "s3:Delete*"
        ],
        "Resource": [
            "arn:aws:s3:::s3_bucket_name",
            "arn:aws:s3:::s3_bucket_name/*"
        ]
    }
]

}

这是一个JSON格式的模板,我很快就把它组合起来了。我在这里的假设是,您的组“所有用户(在我的环境中,nob public)”是帐户中的每个人。因此,我们在第三块中定义它。你可以随心所欲地操纵校长。

如果你有任何问题,请提问,我很乐意帮助你。