3

我正在使用 Amazon cognito 和 S3。我想实现每个用户在 S3 中都有“自己的”目录（教程示例）。所以我设置了以下政策（按照这个例子https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_cognito-bucket.html）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::sg-cognito-s3-bucket-test"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "users"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::sg-cognito-s3-bucket-test/users/${cognito-identity.amazonaws.com:sub}",
                "arn:aws:s3:::sg-cognito-s3-bucket-test/users/${cognito-identity.amazonaws.com:sub}/*"
            ]
        }
    ]
}

问题是我被拒绝访问列表和上传。

但是当我像这样更新第二条规则时：

"Resource": [
                    "arn:aws:s3:::sg-cognito-s3-bucket-test/users",
                    "arn:aws:s3:::sg-cognito-s3-bucket-test/users/*"
                ]

我可以上传文件。

我如何做列表和上传？ 

s3.listObjects({
    Bucket: AppComponent.S3_BUCKET
  }, function(err, data){
  });
s3.putObject({
    Bucket: AppComponent.S3_BUCKET,
    Key: 'users/' + sub + '/' + 'test.txt',
    Body: 'hello, i am: ' + sub
  },function (error, resp) {    
  });

非常感谢 ！

4

0 回答 0