仅允许从IAM策略访问AWS S3中的单个文件

Question

我试图只允许访问S3文件夹中的特定文件&

"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetLifecycleConfiguration",
"s3:GetBucketTagging",
"s3:GetInventoryConfiguration",
"s3:GetObjectVersionTagging",
"s3:ListBucketVersions",
"s3:GetBucketLogging",
"s3:ListBucket",
"s3:GetAccelerateConfiguration",
"s3:GetBucketPolicy",
"s3:GetObjectVersionTorrent",
"s3:GetObjectAcl",
"s3:GetEncryptionConfiguration",
"s3:GetBucketObjectLockConfiguration",
"s3:GetIntelligentTieringConfiguration",
"s3:GetBucketRequestPayment",
"s3:GetObjectVersionAcl",
"s3:GetObjectTagging",
"s3:GetMetricsConfiguration",
"s3:GetBucketOwnershipControls",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketPolicyStatus",
"s3:ListBucketMultipartUploads",
"s3:GetObjectRetention",
"s3:GetBucketWebsite",
"s3:GetBucketVersioning",
"s3:GetBucketAcl",
"s3:GetObjectLegalHold",
"s3:GetBucketNotification",
"s3:GetReplicationConfiguration",
"s3:ListMultipartUploadParts",
"s3:GetObject",
"s3:GetObjectTorrent",
"s3:GetBucketCORS",
"s3:GetAnalyticsConfiguration",
"s3:GetObjectVersionForReplication",
"s3:GetBucketLocation",
"s3:GetObjectVersion"
],
"Resource": [
"arn:aws:s3:::prod-bucket/folder1/folder2/*",
"arn:aws:s3:::prod-bucket/folder3/folder4/my_file.csv",
]
}
]

我能够读取文件夹2内的所有对象，但在试图读取文件夹4内的my_file.csv时，它无法获取它。语法有问题吗?我尝试了多种方法，但无法找出如何限制仅读取特定文件的方法。

Answer 1

如果您不知道如何编写，您可以使用AWS Policy Generator，您可以有这样的东西。

{
"Id": "VisualEditor0",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1634859177800",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::prod-bucket/folder3/folder4/my_file.csv",
"Principal": "*"
},
{
"Sid": "Stmt1634859274600",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::prod-bucket/folder1/folder2/*",
"Principal": "*"
}
]
}

Answer 2

这个策略对我很有效:

{
"Version": "2012-10-17",
"Statement": [
{
"Action": "s3:GetObject",
"Effect": "Allow",
"Resource": "arn:aws:s3:::my-bucket/folder3/folder4/my_file.csv"
}
]
}

我把策略放在IAM用户上，然后使用AWS CLI(作为该用户):

aws s3 cp s3://my-bucket/folder3/folder4/my_file.csv -

它成功地将我以该名称上传的文件打印到我的屏幕上。(连字符将其发送到标准输出)