6

我已经成功创建了一个简单的 HTML 表单，它将上传的文件发布到我的 Amazon S3 存储桶。我按照以下说明操作： http

://aws.amazon.com/articles/1434 现在我正在尝试为可以执行 HTML 表单 POST 的用户创建最小策略。

这是设置：

userID: s3-uploader<br/>
ACCESS-KEY-ID: AXAXAXAXAXAXAXAXAXAX

这是 HTML 表单：

<!DOCTYPE html>
<html>
<head>
    <title>S3 POST Form</title>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
</head>
<body>
<form action="https://<cname-for-upload-bucket>/" method="post" enctype="multipart/form-data">
    <input type="hidden" name="key" value="foo/${filename}">
    <input type="hidden" name="AWSAccessKeyId" value="AXAXAXAXAXAXAXAXAXAX">
    <input type="hidden" name="acl" value="private">
    <input type="hidden" name="success_action_redirect"
           value="https://s3.amazonaws.com/<bucket-01-name>/upload-success.html">
    <input type="hidden" name="policy"   
value="eyJleHBpcmF0aW9uIjogIjIwMTQtMTItMTNUMDA6MDA6MDBaIiwKICAgICJjb25kaXRpb25zIjogWwogICAgICAgIHsiYnVja2V0IjogInMzLXVwLmdyaWR3YXJkLm5ldCJ9LAogICAgICAgIFsic3RhcnRzLXdpdGgiLCAiJGtleSIsICJwZWQvIl0sCiAgICAgICAgeyJhY2wiOiAicHJpdmF0ZSJ9LAogICAgICAgIHsic3VjY2Vzc19hY3Rpb25fcmVkaXJlY3QiOiAiaHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL2dkd2QvdXBsb2FkLXN1Y2Nlc3MuaHRtbCJ9LAogICAgICAgIFsic3RhcnRzLXdpdGgiLCAiJENvbnRlbnQtVHlwZSIsICIiXSwKICAgICAgICBbImNvbnRlbnQtbGVuZ3RoLXJhbmdlIiwgMCwgMTA0ODU3Nl0KICAgIF0KfQ==">
    <input type="hidden" name="signature" value="WnbMCo0OY7g8oYkfxrVb8np4l94=">
    <input type="hidden" name="Content-Type" value="image/jpeg">
    <!-- Include any additional input fields here -->

    File to upload to S3:
    <input name="file" type="file">
    <br>
    <input type="submit" value="Upload File to S3">
</form>
</body>
</html>

...然后我有这是表单隐藏输入“策略”的未编码版本：

{"expiration": "2014-12-13T00:00:00Z",
    "conditions": [
        {"bucket": "<cname-for-upload-bucket>"},
        ["starts-with", "$key", "foo/"],
        {"acl": "private"},
        {"success_action_redirect": "https://s3.amazonaws.com/<bucket-01-name>/upload-success.html"},
        ["starts-with", "$Content-Type", ""],
        ["content-length-range", 0, 1048576]
    ]
}

当 userId: s3-uploader 具有以下策略时，这一切都有效：

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

...但是如果我将策略更改为更明确的内容，但看起来仍然合理，我会从完全相同的 HTML 表单帖子中收到一条 <AccessDenied/> 消息。

这是我尝试过的更严格的政策：

{
    "Statement": [
        {
            "Sid": "AllowS3uploader",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:PutBucketAcl",
                "s3:PutBucketPolicy",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::<cname-for-upload-bucket>",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::756342427722:user/s3-uploader"
                ]
            }
        }
    ]
}

我已经阅读了这里的文档，但没有获得额外的清晰度：
http

://docs.aws.amazon.com/AmazonS3/latest/dev/UsingIAMPolicies.html 所以我问我的溢出者，我错过了什么？我真的不希望s3-uploader userId 能够对存储桶执行任何操作（即's3：*'）。

4

1 回答 1

3

您在 Resource 部分中使用的 ARN 错误，您必须使用实际存储桶名称而不是 CNAME 条目。

于 2013-09-26T23:19:53.197 回答