我的 AWS 账户中有很多 S3 存储桶。但是现在我创建了一个 IAM 用户和一个新的 S3 存储桶，我想让这个用户能够使用 CyberDuck 之类的客户端访问新的 S3 存储桶。
我试图制定这么多政策。但在那之后，这个用户也获得了列出我所有其他存储桶的权限。如何授予对单个 S3 存储桶的列出和写入访问权限？
问问题
12482 次
5 回答
9
首先，您创建一个策略以允许访问单个 S3 存储桶（IAM -> 策略 -> 创建策略）。您可以使用 AWS 策略生成器 ( http://awspolicygen.s3.amazonaws.com/policygen.html )，它应该如下所示：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1528735049406",
"Action": [
"s3:DeleteObject",
"s3:GetObject",
"s3:HeadBucket",
"s3:ListBucket",
"s3:ListObjects",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::YOURBUCKETNAME"
}
]
}
保存策略并记下您为其指定的名称，然后转到 IAM -> 用户并选择所需的用户。在权限选项卡中，单击“添加权限”，然后选择顶部附近的“直接附加现有策略”。按名称查找您的保单，勾选其复选框并完成该过程。
于 2018-06-11T16:46:07.967 回答
3
他们至少需要能够列出所有存储桶。但除此之外，这还提供了一个示例策略，我昨晚刚刚将其用于我自己的帐户，因此我可以确认它有效。
更新 好的，我已经使用 CyberDuck 进行了测试并确认，以下策略（当然是根据您的环境定制的）将阻止用户查看所有根存储桶，并且只允许他们访问您指定的存储桶：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAllInBucket",
"Action": [
"s3:*"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::bucket-for-single-user"
}
]
}
只需确保在 CyberDuck 中指定路径时，将其输入为：bucket-for-single-user.s3.amazonaws.com。
此外，只有这样不受限制地开始，只是为了确保它对您有用（因为访问似乎是一个问题）。之后，应用限制，你知道......最小特权和所有。
于 2018-06-11T16:52:58.207 回答
2
根据Cyberduck Help / Howto / Amazon S3，它支持直接输入 Bucket 名称，如<bucketname>.s3.amazonaws.com. 如果您使用的客户端可以做到这一点，则您不需要s3:ListAllMyBuckets权限。
Action应该按它们可以解析的Resource分组（每个Action的条件也可能不同）。
此 IAM 策略将允许完全控制所有内容（又名存储桶中），而无需控制 S3 存储桶子资源（又名存储桶）：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "BucketOperations",
"Effect": "Allow",
"Action": "s3:ListBucket*",
"Resource": "arn:aws:s3:::<bucketname>"
},
{
"Sid": "ObjectOperations",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:ListMultipartUploads",
"s3:DeleteObject*",
"s3:GetObject*",
"s3:PutObject*"
],
"Resource": "arn:aws:s3:::<bucketname>/*"
},
{
"Sid": "DenyAllOthers",
"Effect": "Deny",
"Action": "s3:*",
"NotResource": [
"arn:aws:s3:::<bucketname>",
"arn:aws:s3:::<bucketname>/*"
]
}
]
}
如果您不是专门尝试将 IAM 用户锁定在每个可能的公共 S3 存储桶之外，则可以关闭“DenyAllOthers” Sid，而不向用户授予额外权限。
仅供参考，AWSReadOnlyAccess政策会自动赋予s3:*它附加的任何东西。我推荐ViewOnlyAccess（不幸s3:ListAllMyBuckets的是，没有DenyAllOthers.
于 2018-08-06T22:32:26.793 回答
0
创建我自己的政策并为我工作。IAM 用户可以只列出所有存储桶。但不能在另一个桶上做任何事情。用户只能访问具有读取、写入、删除文件权限的特定存储桶。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "<EXAMPLE_SID>",
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::<MYBUCKET>"
},
{
"Sid": "<EXAMPLE_SID>",
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}, {
"Sid": "<EXAMPLE_SID>",
"Effect": "Deny",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::<MYotherBUCKET>"
}, {
"Sid": "<EXAMPLE_SID>",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::<MYBUCKET>/*"
}
]
}
然后将此策略也添加到该用户。此策略会将所有类型的操作限制为列出的其他 s3 存储桶。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "<EXAMPLE_SID>",
"Effect": "Deny",
"Action": [
"s3:PutAnalyticsConfiguration",
"s3:GetObjectVersionTagging",
"s3:CreateBucket",
"s3:ReplicateObject",
"s3:GetObjectAcl",
"s3:DeleteBucketWebsite",
"s3:PutLifecycleConfiguration",
"s3:GetObjectVersionAcl",
"s3:PutBucketAcl",
"s3:PutObjectTagging",
"s3:DeleteObject",
"s3:GetIpConfiguration",
"s3:DeleteObjectTagging",
"s3:GetBucketWebsite",
"s3:PutReplicationConfiguration",
"s3:DeleteObjectVersionTagging",
"s3:GetBucketNotification",
"s3:PutBucketCORS",
"s3:DeleteBucketPolicy",
"s3:GetReplicationConfiguration",
"s3:ListMultipartUploadParts",
"s3:PutObject",
"s3:GetObject",
"s3:PutBucketNotification",
"s3:PutBucketLogging",
"s3:PutObjectVersionAcl",
"s3:GetAnalyticsConfiguration",
"s3:GetObjectVersionForReplication",
"s3:GetLifecycleConfiguration",
"s3:ListBucketByTags",
"s3:GetInventoryConfiguration",
"s3:GetBucketTagging",
"s3:PutAccelerateConfiguration",
"s3:DeleteObjectVersion",
"s3:GetBucketLogging",
"s3:ListBucketVersions",
"s3:ReplicateTags",
"s3:RestoreObject",
"s3:GetAccelerateConfiguration",
"s3:GetBucketPolicy",
"s3:PutEncryptionConfiguration",
"s3:GetEncryptionConfiguration",
"s3:GetObjectVersionTorrent",
"s3:AbortMultipartUpload",
"s3:PutBucketTagging",
"s3:GetBucketRequestPayment",
"s3:GetObjectTagging",
"s3:GetMetricsConfiguration",
"s3:DeleteBucket",
"s3:PutBucketVersioning",
"s3:PutObjectAcl",
"s3:ListBucketMultipartUploads",
"s3:PutMetricsConfiguration",
"s3:PutObjectVersionTagging",
"s3:GetBucketVersioning",
"s3:GetBucketAcl",
"s3:PutInventoryConfiguration",
"s3:PutIpConfiguration",
"s3:GetObjectTorrent",
"s3:ObjectOwnerOverrideToBucketOwner",
"s3:PutBucketWebsite",
"s3:PutBucketRequestPayment",
"s3:GetBucketCORS",
"s3:PutBucketPolicy",
"s3:GetBucketLocation",
"s3:ReplicateDelete",
"s3:GetObjectVersion"
],
"Resource": [
"arn:aws:s3:::<MYotherBUCKET>/*",
"arn:aws:s3:::<MYotherBUCKET>"
]
}
]
}
于 2018-06-12T06:11:56.307 回答
0
我最近能够使用亚马逊的文档来实现这一点。对我来说，关键是将 IAM 用户指向特定的存储桶，而不是 S3 控制台。根据文档，“警告：更改这些权限后，用户在访问主 Amazon S3 控制台时会收到拒绝访问错误。主控制台链接类似于以下内容：
https://s3.console.aws.amazon.com/s3/home
相反，用户必须使用指向存储桶的直接控制台链接来访问存储桶，类似于以下内容：
https://s3.console.aws.amazon.com/s3/buckets/awsexamplebucket/ "
我的政策如下：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1589486662000",
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::AWSEXAMPLEBUCKET",
"arn:aws:s3:::AWSEXAMPLEBUCKET/*"
]
}
]
}
于 2020-05-15T14:22:17.510 回答