Amazon web services 允许CloudFront使用源站访问标识访问S3存储桶

我已经创建了一个静态网站，托管了CloudFront提供的S3 bucket。我想通过源访问标识直接限制CloudFront对bucket的访问

我已尝试更新S3 bucket策略，但它显示错误：

Error putting S3 policy: MalformedPolicy: Invalid principal in policy status code: 400, request id

我尝试使用以下策略：

resource "aws_s3_bucket_policy" "default" {
  bucket = "${aws_s3_bucket.default.id}"
  policy = <<EOF
  {
"Version": "2008-10-17",
"Statement": [
    {
        "Sid": "2",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${aws_cloudfront_origin_access_identity.origin_access_identity.id}"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::$/*"
    }
  ]
}
EOF 
}

资源“aws\U s3\U bucket\U策略”“默认”{
bucket=“${aws\u s3\u bucket.default.id}”
policy=如本文中所述，最好的方法是生成IAM策略文档
使用，然后直接连接

示例如下所示：

data "aws_iam_policy_document" "s3_policy" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["${module.names.s3_endpoint_arn_base}/*"]

    principals {
      type        = "AWS"
      identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
    }
  }

  statement {
    actions   = ["s3:ListBucket"]
    resources = ["${module.names.s3_endpoint_arn_base}"]

    principals {
      type        = "AWS"
      identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
    }
  }
}

resource "aws_s3_bucket" "bucket" {
  # ...
  policy = "${data.aws_iam_policy_document.s3_policy.json}"
}

resource "aws_s3_bucket_policy" "default" {
  bucket = "${aws_s3_bucket.default.id}"
  policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
    {
        "Sid": "2",
        "Effect": "Allow",
        "Principal": {
            "AWS": "${aws_cloudfront_origin_access_identity.origin_access_identity.id}"
        },
        "Action": "s3:*",
        "Resource": "${aws_s3_bucket.default.arn}""
    }
  ]
}
EOF 
}

如果您真的想手工制定问题中的IAM政策，那么您只需要以下内容：

data "aws_iam_policy_document" "s3_policy" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["${module.names.s3_endpoint_arn_base}/*"]

    principals {
      type        = "AWS"
      identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
    }
  }

  statement {
    actions   = ["s3:ListBucket"]
    resources = ["${module.names.s3_endpoint_arn_base}"]

    principals {
      type        = "AWS"
      identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
    }
  }
}

resource "aws_s3_bucket" "bucket" {
  # ...
  policy = "${data.aws_iam_policy_document.s3_policy.json}"
}

resource "aws_s3_bucket_policy" "default" {
  bucket = "${aws_s3_bucket.default.id}"
  policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
    {
        "Sid": "2",
        "Effect": "Allow",
        "Principal": {
            "AWS": "${aws_cloudfront_origin_access_identity.origin_access_identity.id}"
        },
        "Action": "s3:*",
        "Resource": "${aws_s3_bucket.default.arn}""
    }
  ]
}
EOF 
}

资源“aws\U s3\U bucket\U策略”“默认”{
bucket=“${aws\u s3\u bucket.default.id}”
policy=谢谢。我将实现这一点。请注意，如果您使用第三资源aws_s3_bucket_策略将策略附加到bucket上，则可以避免循环依赖。更多信息：