AWS IAM 策略:按用户/角色限制存储桶/文件夹访问?

Question

我试图按角色限制用户仅访问 S3 存储桶中的特定文件夹。可以说，该存储桶配置为"模拟安装"，以便我们可以将其用于文件共享，就好像它是更传统的服务器一样。每个用户都在使用CloudBerry远程访问S3。

这是我当前的(已损坏的)策略，存储桶名称为"bluebolt"。

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUserToSeeBucketListInTheConsole",
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListAllMyBuckets"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Sid": "AllowRootAndHomeListingOfCompanySharedAndPAndP",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::bluebolt"
],
"Condition": {
"StringEquals": {
"s3:prefix": [
"",
"Production and Processing/",
"Production and Processing/${aws:username}",
"Company Shared/"
],
"s3:delimiter": [
"/"
]
}
}
},
{
"Sid": "AllowListingOfCompanyShared",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::bluebolt"
],
"Condition": {
"StringLike": {
"s3:prefix": [
"Company Shared/*"
]
}
}
},
{
"Sid": "AllowListingOfUserFolder",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::bluebolt"
],
"Condition": {
"StringLike": {
"s3:prefix": [
"Production and Processing/${aws:username}/",
"Production and Processing/${aws:username}/*"
]
}
}
},
{
"Sid": "AllowAllS3ActionsCompanyShared",
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::bluebolt/Company Shared/*"
]
},
{
"Sid": "AllowAllS3ActionsInUserFolder",
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::bluebolt/Production and Processing/${aws:username}/*"
]
},
{
"Sid": "DenyAllS3ActionsInManagement",
"Effect": "Deny",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::bluebolt/Management/*"
]
}
]

}

因此，我想做的是限制用户仅列出/读取/写入"/生产和加工/[用户名]"中的内容，同时能够列出/读取"/公司共享"中的所有内容，同时明确禁止所有访问"/Management"以及"/生产和加工/*"中的所有内容，除了他们的用户文件夹。理想情况下，用户只会在 bluebolt 中看到"/公司共享"和"/生产和加工"，一旦他们进入"/生产和加工"，他们只会看到他们的用户命名文件夹，即他们的工作区。

现在，一旦用户在 bluebolt 顶级存储桶下方挖掘，我就会获得零星的访问权限("您无权访问")。

我不知道这个用例是否常见，或者我是否试图将一个太方形的钉子放入圆孔中，但欢迎并非常感谢任何反馈/提示/类似的政策应用/严厉的批评！

Answer 1

具有联合身份用户的 IAM 策略变量

${aws：userName} 策略变量不适用于角色。使用 ${aws：userID} 策略变量而不是 ${aws：userName} 策略变量。

${aws：userid} 变量将为 "ROLEID：caller-specified -name"。

我对aws:userid和角色使用了相同的策略。

1. 获取角色 ID。

   iam get-role --role-name Arsenal-role --query Role.RoleId
   AROAXXT2NJT7D3SIQN7Z6
   

2. 要求用户上传到Bucket/Prefix/<RoleID:SessionName>/

   aws s3 cp test.txt 's3://mydemo/Production and Processing/AROAXXT2NJT7D3SIQN7Z6:john/' --profile s3role
   upload: ./test.txt to s3://mydemo/Production and Processing/AROAXX2NJT7D3SIQN7Z6:john/test.txt
   aws s3 cp test.txt 's3://mydemo/Management/' --profile s3role
   upload failed: ./test.txt to s3://mydemo/Management/test.txt An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
   aws s3 cp test.txt 's3://mydemo/Production and Processing/' --profile s3role
   upload failed: ./test.txt to s3://mydemo/Production and Processing An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
   

Answer 2

这是我开始工作的代码。

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowListingOfUserFolder",
"Action": [
"s3:ListBucket"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::bluebolt"
],
"Condition": {
"StringLike": {
"s3:prefix": [
"*",
"bluebolt/Company Shared/*",
"bluebolt/Production and Processing/*",
"bluebolt/Production and Processing/${aws:userName}/*"
]
}
}
},
{
"Sid": "AllowAllS3ActionsInUserFolder",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:GetObjectVersion",
"s3:DeleteObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::bluebolt/Production and Processing/${aws:userName}/*"
]
},
{
"Sid": "AllowCertainS3ActionsInCompanyShared",
"Action": [
"s3:GetObject",
"s3:GetObjectVersion"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::bluebolt/Company Shared/*"
]
}
]

}