授予AWS Config对Amazon S3 Bucket的访问权限

Question

我想创建对Amazon S3 Bucket的AWS Config访问权限，下面提供了我根据链接编写的策略https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSConfigBucketPermissionsCheck",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::targetBucketName"
},
{
"Sid": "AWSConfigBucketExistenceCheck",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::targetBucketName"
},
{
"Sid": "AWSConfigBucketDelivery",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"    
]
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::targetBucketName/[optional] prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*",
"Condition": { 
"StringEquals": { 
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}   

我想知道下面提供的部分：

"Resource": "arn:aws:s3:::targetBucketName/[optional] prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*",

prefix的含义是什么？如何填写策略的prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*部分？

谢谢。

Answer 1

前缀是您在配置S3日志记录时定义的。这是可选的。Config使用标准路径/密钥格式将日志写入S3桶；prefix/AWSLogs/sourceAccountIDWithoutHyphens/Config/*"；。

如果您从控制台将Config日志记录配置到S3，您就不必担心bucket策略，因为它将自动创建。您只需提供bucket名称和可选前缀。