针对新IAM用户的新创建的IAM内联策略上的AWS S3 403禁止错误 [英] AWS S3 403 Forbidden Error on newly created IAM inline policy for a new IAM user

问题描述

我有一个全新的IAM用户，我想为其进行上传&对我新创建的存储区-myapp的读访问权限.

I have a brand new IAM user that I want to give upload & read access to my newly created bucket - myapp.

这是我现在为用户使用的政策:

This is the policy I am using for my user now:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::myapp"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::myapp/*"
            ]
        }
    ]
}

使用此策略，我可以登录到控制台，可以创建文件夹，也可以将图像上传到这些文件夹.

With this policy, I can login to the console, I can create folders and I can upload images to these folders.

但是，当我尝试通过我的应用上传图片时，这就是我得到的:

However, when I attempt to upload an image through my app, this is what I get:

Excon::Errors::Forbidden at /jobs
Expected(200) <=> Actual(403 Forbidden)
excon.error.response
  :body          => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>0FF1D4848595DCFB</RequestId><HostId>+RrQvNFwV2hAcYPK3ZJJYzy5uiA7Aag0oc1Gpp3hENJ9lzJz453j8qJeLbdQ8jN4cc3ViRJ1lEg=</HostId></Error>"
  :cookies       => [
  ]
  :headers       => {
    "Connection"       => "close"
    "Content-Type"     => "application/xml"
    "Date"             => "Sat, 25 Jun 2016 18:54:24 GMT"
    "Server"           => "AmazonS3"
    "x-amz-id-2"       => "+R3ViRJ1lEg="
    "x-amz-request-id" => "0FF1DCFB"
  }
  :host          => "s3.amazonaws.com"
  :local_address => "192.168.1.102"
  :local_port    => 23456
  :path          => "/logos/company/logo/48/amped-logo.png"
  :port          => 443
  :reason_phrase => "Forbidden"
  :remote_ip     => "xx.xx.xxx.xxx"
  :status        => 403
  :status_line   => "HTTP/1.1 403 Forbidden\r\n"

这是我的CORS规则:

Here are my CORS rules:

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <CORSRule>
        <AllowedOrigin>http://localhost:3000</AllowedOrigin>
        <AllowedMethod>HEAD</AllowedMethod>
        <AllowedMethod>GET</AllowedMethod>
        <AllowedMethod>PUT</AllowedMethod>
        <AllowedMethod>POST</AllowedMethod>
        <AllowedMethod>DELETE</AllowedMethod>
        <ExposeHeader>ETag</ExposeHeader>
        <AllowedHeader>*</AllowedHeader>
    </CORSRule>
</CORSConfiguration>

这是我的config/initializers/carrierwave.rb文件:

CarrierWave.configure do |config|
  config.fog_credentials = {
    provider:               'AWS',
    aws_access_key_id:      ENV["MYAPP_S3_KEY"],
    aws_secret_access_key: ENV["MYAPP_SECRET_KEY"]
  }
  config.fog_directory  = ENV["MYBUCKET"]
end

这可能是什么原因以及如何解决?

What could be causing this and how do I fix it?

推荐答案

我实际上只是想通了，这是一件小事.

I actually just figured it out, and it was one small thing.

我要做的就是将"s3:PutObjectAcl"添加到我的策略中.

All I had to do was add "s3:PutObjectAcl" to my policy.

现在，我的政策如下:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::myapp"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::myapp/*"
            ]
        }
    ]
}

现在可行.

我从此答案中获得了提示，节省了我的培根.

I got the tip from this answer, which saved my bacon.

这篇关于针对新IAM用户的新创建的IAM内联策略上的AWS S3 403禁止错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！