Amazon s3 访问s3存储桶的IAM策略允许意外的对象获取操作

给定这些桶键：

我的permtest/
我的permtest/rootfile.txt
我的个人测试/财务
我的permtest/Finance/financefile.txt
我的permtest/收藏
我的permtest/Collections/collectionfile.txt
我的permtest/共享
我的permtest/Shared/sharedfile.txt

这项政策：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AllowListAllMyBuckets",
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets",
            "s3:GetBucketLocation"
        ],
        "Resource": [
            "arn:aws:s3:::*"
        ]
    },
    {
        "Sid": "AllowedListAccess",
        "Effect": "Allow",
        "Action": [
            "s3:ListBucket",
            "s3:GetBucketAcl",
            "s3:GetBucketLocation"
        ],
        "Resource": [
            "arn:aws:s3:::my-permtest",
            "arn:aws:s3:::my-permtest/Collections",
            "arn:aws:s3:::my-permtest/Shared"
        ]
    },
    {
        "Sid": "AllowAllObjectActionsNotExplicitlyDenied",
        "Effect": "Allow",
        "Action": [
            "s3:*Object*"
        ],
        "Resource": [
            "arn:aws:s3:::my-permtest/*"
        ]
    },
    {
        "Sid": "DenyAllFinanceAccess",
        "Effect": "Deny",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::my-permtest/Finance"
        ]
    }
]
}  

为什么我能够在s3://my permtest/Finance/financefile.txt上执行get和put？

---

我认为“Sid”：“DenyAllFinanceAccess”块应该禁止这种访问。

这一块原来很简单。 我还需要拒绝对财务键下的所有对象执行所有操作 具体来说

    "Sid": "DenyAllFinanceAccess",

块需要修改为：

{
    "Sid": "DenyAllFinanceAccess",
    "Effect": "Deny",
    "Action": [
        "s3:*"
    ],
    "Resource": [
        "arn:aws:s3:::my-permtest/Finance",
        "arn:aws:s3:::my-permtest/Finance/*"
    ]
}

---

如果其他人给出更好的答案，我会接受他们的答案，否则在网站允许的情况下，我会接受自己的答案。