S3存储桶策略以允许访问特定用户并限制所有 [英] S3 Bucket Policy to Allow access to specific users and restrict all
问题描述
我搜索了现有问题,但找不到答案.因此在这里发布.
I searched through existing questions and couldnt find an answer. Hence posting here.
我想将对S3存储桶的访问限制为所有用户,但使用S3存储桶策略选择少数用户除外.我知道IAM策略易于管理,我不喜欢为此特定情况创建角色和组,而希望创建S3存储桶策略.
I want to restrict access to a S3 bucket to all users except select few users using S3 Bucket policy. I understand IAM policy is easy to manage and administer, i dont like to create roles and groups for this specific case and want S3 bucket policy created.
这是我到目前为止已经尝试过的方法,它并没有像预期的那样限制对用户的访问.
Here is what i have tried so far and it is not restricting access to users as expected.
{
"Version": "2012-10-17",
"Id": "bucketPolicy",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": ["arn:aws:iam::1234567890:user/allowedusername"]
},
"Action": "s3:*",
"Resource": ["arn:aws:s3:::examplebucket",
"arn:aws:s3:::examplebucket/*"]
},
{
"Effect": "Deny",
"Principal": {
"AWS": ["arn:aws:iam::1234567890:user/denieduser"]
},
"Action": "s3:*",
"Resource": ["arn:aws:s3:::examplebucket",
"arn:aws:s3:::examplebucket/*"]
}
]
}
我试图否认所有类似下面的内容,但是该明确的拒绝优先于allow,我本人现在无法访问存储桶;-(那是我遇到的另一个问题
I tried to deny all like below but that explicit deny took precedence over allow and i myself am not able to access the bucket now ;-( Thats another issue i have
{
"Effect": "Deny",
"Principal": {
"AWS": ["*"]
},
"Action": "s3:*",
"Resource": ["arn:aws:s3:::examplebucket",
"arn:aws:s3:::examplebucket/*"]
}
推荐答案
要实现所需的功能,请使用带有"NotPrincipal"策略元素的显式拒绝.以下策略将确保"NotPrincipal"元素中列出的用户以外的其他用户无法访问存储桶.
To achieve what you want, use an explicit deny with a "NotPrincipal" policy element. The policy below will ensure no other user can access the buckets other than the users listed in the "NotPrincipal" element.
{
"Id": "bucketPolicy",
"Statement": [
{
"Action": "s3:*",
"Effect": "Deny",
"NotPrincipal": {
"AWS": [
"arn:aws:iam::1234567890:user/alloweduser"
]
},
"Resource": [
"arn:aws:s3:::examplebucket",
"arn:aws:s3:::examplebucket/*"
]
}
],
"Version": "2012-10-17"
}
这篇关于S3存储桶策略以允许访问特定用户并限制所有的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!