创建单个 IAM 用户以仅访问特定的 S3 存储桶

Question

我的 AWS 账户中有许多 S3 存储桶。但是现在我创建了一个 IAM 用户和一个新的 S3 存储桶，我想让这个用户能够使用 CyberDuck 等客户端访问新的 S3 存储桶。

我试图创建这么多策略。但在那之后，该用户也获得了列出我所有其他存储桶的权限。如何授予对单个 S3 存储桶的列出和写入访问权限？

Answer 1

首先，您创建一个策略以允许访问单个 S3 存储桶(IAM -> 策略 -> 创建策略(。您可以使用 AWS 策略生成器 (http://awspolicygen.s3.amazonaws.com/policygen.html(，它应如下所示：

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1528735049406",
"Action": [
"s3:DeleteObject",
"s3:GetObject",
"s3:HeadBucket",
"s3:ListBucket",
"s3:ListObjects",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::YOURBUCKETNAME"
}
]
}

保存策略并记下您为其指定的名称，然后转到 IAM -> 用户并选择所需的用户。在权限选项卡中，单击"添加权限"，然后选择顶部附近的"直接附加现有策略"。按名称查找您的保单，勾选其复选框并完成该过程。

Answer 2

根据这个 ( https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/(

他们至少需要能够列出所有存储桶。但除此之外，这还提供了一个示例策略，我昨晚刚刚将其用于我自己的帐户，因此我可以确认它是否有效。

更新好的，我已经使用 CyberDuck 测试并确认以下策略(当然是根据您的环境自定义的(将阻止用户查看所有根存储桶，并且只允许他们访问您指定的存储桶：

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAllInBucket",
"Action": [
"s3:*"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::bucket-for-single-user"
}
]
}

只要确保在 CyberDuck 中指定路径时，输入的路径为：bucket-for-single-user.s3.amazonaws.com。

此外，只有像这样不受限制地开始，只是为了确保它对您有用(因为访问似乎是一个问题(。之后，应用限制，你知道...最小特权和所有。

Answer 3

根据 Cyberduck Help/Howto/Amazon S3，它支持直接输入存储桶名称，如<bucketname>.s3.amazonaws.com。如果您可以使用的客户端执行此操作，则不需要s3:ListAllMyBuckets权限。

操作应按它们可以解析的资源进行分组(每个操作的条件也可能不同(。

此 IAM 策略将允许完全控制所有内容(即存储桶中的内容( 在不控制 S3 存储桶子资源(也称为存储桶(的情况下：

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "BucketOperations",
"Effect": "Allow",
"Action": "s3:ListBucket*",
"Resource": "arn:aws:s3:::<bucketname>"
},
{
"Sid": "ObjectOperations",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:ListMultipartUploads",
"s3:DeleteObject*",
"s3:GetObject*",
"s3:PutObject*"
],
"Resource": "arn:aws:s3:::<bucketname>/*"
},
{
"Sid": "DenyAllOthers",
"Effect": "Deny",
"Action": "s3:*",
"NotResource": [
"arn:aws:s3:::<bucketname>",
"arn:aws:s3:::<bucketname>/*"
]
}
] 
}

如果您没有专门尝试将 IAM 用户锁定在每个用户之外 可能的公共 S3 存储桶，您可以将"拒绝所有其他人"Sid关闭， 不向用户授予其他权限。

仅供参考，AWSReadOnlyAccess策略会自动s3:*它所依附的任何东西。我推荐ViewOnlyAccess(这将 不幸的是，格兰特s3:ListAllMyBuckets没有DenyAllOthers(。

Answer 4

创建我自己的策略并为我工作。IAM 用户只需列出所有存储桶。但是不能在另一个桶上做任何事情。用户只能以读取、写入、删除文件权限访问特定存储桶。

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "<EXAMPLE_SID>",
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::<MYBUCKET>"
},
{
"Sid": "<EXAMPLE_SID>",
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
},  {
"Sid": "<EXAMPLE_SID>",
"Effect": "Deny",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::<MYotherBUCKET>"
},  {
"Sid": "<EXAMPLE_SID>",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::<MYBUCKET>/*"
}
] 
}

然后将此策略也添加到此用户。此策略会将所有类型的操作限制为列出的其他 s3 存储桶。

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "<EXAMPLE_SID>",
"Effect": "Deny",
"Action": [
"s3:PutAnalyticsConfiguration",
"s3:GetObjectVersionTagging",
"s3:CreateBucket",
"s3:ReplicateObject",
"s3:GetObjectAcl",
"s3:DeleteBucketWebsite",
"s3:PutLifecycleConfiguration",
"s3:GetObjectVersionAcl",
"s3:PutBucketAcl",
"s3:PutObjectTagging",
"s3:DeleteObject",
"s3:GetIpConfiguration",
"s3:DeleteObjectTagging",
"s3:GetBucketWebsite",
"s3:PutReplicationConfiguration",
"s3:DeleteObjectVersionTagging",
"s3:GetBucketNotification",
"s3:PutBucketCORS",
"s3:DeleteBucketPolicy",
"s3:GetReplicationConfiguration",
"s3:ListMultipartUploadParts",
"s3:PutObject",
"s3:GetObject",
"s3:PutBucketNotification",
"s3:PutBucketLogging",
"s3:PutObjectVersionAcl",
"s3:GetAnalyticsConfiguration",
"s3:GetObjectVersionForReplication",
"s3:GetLifecycleConfiguration",
"s3:ListBucketByTags",
"s3:GetInventoryConfiguration",
"s3:GetBucketTagging",
"s3:PutAccelerateConfiguration",
"s3:DeleteObjectVersion",
"s3:GetBucketLogging",
"s3:ListBucketVersions",
"s3:ReplicateTags",
"s3:RestoreObject",
"s3:GetAccelerateConfiguration",
"s3:GetBucketPolicy",
"s3:PutEncryptionConfiguration",
"s3:GetEncryptionConfiguration",
"s3:GetObjectVersionTorrent",
"s3:AbortMultipartUpload",
"s3:PutBucketTagging",
"s3:GetBucketRequestPayment",
"s3:GetObjectTagging",
"s3:GetMetricsConfiguration",
"s3:DeleteBucket",
"s3:PutBucketVersioning",
"s3:PutObjectAcl",
"s3:ListBucketMultipartUploads",
"s3:PutMetricsConfiguration",
"s3:PutObjectVersionTagging",
"s3:GetBucketVersioning",
"s3:GetBucketAcl",
"s3:PutInventoryConfiguration",
"s3:PutIpConfiguration",
"s3:GetObjectTorrent",
"s3:ObjectOwnerOverrideToBucketOwner",
"s3:PutBucketWebsite",
"s3:PutBucketRequestPayment",
"s3:GetBucketCORS",
"s3:PutBucketPolicy",
"s3:GetBucketLocation",
"s3:ReplicateDelete",
"s3:GetObjectVersion"
],
"Resource": [
"arn:aws:s3:::<MYotherBUCKET>/*",
"arn:aws:s3:::<MYotherBUCKET>"
]
}
]
}

Answer 5

我最近能够使用亚马逊的文档来解决这个问题。对我来说，关键是将 IAM 用户指向特定的存储桶，而不是 S3 控制台。根据文档，"警告：更改这些权限后，用户在访问主 Amazon S3 控制台时会收到"拒绝访问"错误。主控制台链接类似于以下内容：

https://s3.console.aws.amazon.com/s3/home

相反，用户必须使用指向存储桶的直接控制台链接访问存储桶，类似于以下内容：

https://s3.console.aws.amazon.com/s3/buckets/awsexamplebucket/">

我的政策如下：

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1589486662000",
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::AWSEXAMPLEBUCKET",
"arn:aws:s3:::AWSEXAMPLEBUCKET/*"
]
}
]
}