Amazon web services aws s3存储桶策略未按预期工作
我在一个AWS帐户中有一个s3存储桶,比如ACCID1。我想允许root用户和一个特定的用户USER1对其拥有完全访问权限。从另一个帐户ACCID2,我有IAM角色,我想附加到EC2实例,只允许从该IAM角色访问。 角色是备份完全访问(读、写和删除)。 我创建了以下bucket策略,但无法通过使用上述IAM角色(在ACCID2中)启动的EC2实例访问bucket。 我能够从EC2实例中使用它作为ACCID1中的USER1,并执行列表、创建和删除Amazon web services aws s3存储桶策略未按预期工作,amazon-web-services,amazon-s3,amazon-iam,s3-bucket,Amazon Web Services,Amazon S3,Amazon Iam,S3 Bucket,我在一个AWS帐户中有一个s3存储桶,比如ACCID1。我想允许root用户和一个特定的用户USER1对其拥有完全访问权限。从另一个帐户ACCID2,我有IAM角色,我想附加到EC2实例,只允许从该IAM角色访问。 角色是备份完全访问(读、写和删除)。 我创建了以下bucket策略,但无法通过使用上述IAM角色(在ACCID2中)启动的EC2实例访问bucket。 我能够从EC2实例中使用它作为ACCID1中的USER1,并执行列表、创建和删除 { "Version":"2012-10
{
"Version":"2012-10-17",
"Id":"BackupBucketPolicy",
"Statement":[
{
"Sid":"DenyAllOther",
"Effect":"Deny",
"NotPrincipal":{
"AWS":[
"arn:aws:iam::ACCID1:user/USER1",
"arn:aws:iam::ACCID1:root",
"arn:aws:iam::ACCID2:role/backup-full-access"
]
},
"Action":"s3:*",
"Resource":[
"arn:aws:s3:::test-nr-6",
"arn:aws:s3:::test-nr-6/*"
]
},
{
"Sid":"DevAccountRootFullAccess",
"Effect":"Allow",
"Principal":{
"AWS":[
"arn:aws:iam::ACCID1:user/USER1",
"arn:aws:iam::ACCID1:root"
]
},
"Action":"s3:*",
"Resource":[
"arn:aws:s3:::test-nr-6",
"arn:aws:s3:::test-nr-6/*"
]
},
{
"Sid":"GraphBackupReadWriteDeleteAccess",
"Effect":"Allow",
"Principal":{
"AWS":"arn:aws:iam::ACCID2:role/backup-full-access"
},
"Action":[
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource":[
"arn:aws:s3:::test-nr-6",
"arn:aws:s3:::test-nr-6/*"
]
}
]
}
IAM角色备份完全访问权限具有以下策略:
{
"Version":"2012-10-17",
"Statement":[
{
"Sid":"Stmt2",
"Effect":"Allow",
"Action":[
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource":[
"arn:aws:s3:::test-nr-6",
"arn:aws:s3:::test-nr-6/*"
]
}
]
}
我不知道这里出了什么问题。
任何帮助都将不胜感激。首先,您不需要拒绝所有其他策略,因为默认情况下S3存储桶权限是拒绝的
其次,创建跨帐户访问时,需要将备份完全访问
角色的类型设置为角色
最后,您的角色策略应写成:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::test-nr-6"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::test-nr-6/*"
}
]
}
资料来源: