我正在嘗試只允許訪問 S3 檔案夾中的特定檔案并在 IAM 策略下嘗試
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetLifecycleConfiguration",
"s3:GetBucketTagging",
"s3:GetInventoryConfiguration",
"s3:GetObjectVersionTagging",
"s3:ListBucketVersions",
"s3:GetBucketLogging",
"s3:ListBucket",
"s3:GetAccelerateConfiguration",
"s3:GetBucketPolicy",
"s3:GetObjectVersionTorrent",
"s3:GetObjectAcl",
"s3:GetEncryptionConfiguration",
"s3:GetBucketObjectLockConfiguration",
"s3:GetIntelligentTieringConfiguration",
"s3:GetBucketRequestPayment",
"s3:GetObjectVersionAcl",
"s3:GetObjectTagging",
"s3:GetMetricsConfiguration",
"s3:GetBucketOwnershipControls",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketPolicyStatus",
"s3:ListBucketMultipartUploads",
"s3:GetObjectRetention",
"s3:GetBucketWebsite",
"s3:GetBucketVersioning",
"s3:GetBucketAcl",
"s3:GetObjectLegalHold",
"s3:GetBucketNotification",
"s3:GetReplicationConfiguration",
"s3:ListMultipartUploadParts",
"s3:GetObject",
"s3:GetObjectTorrent",
"s3:GetBucketCORS",
"s3:GetAnalyticsConfiguration",
"s3:GetObjectVersionForReplication",
"s3:GetBucketLocation",
"s3:GetObjectVersion"
],
"Resource": [
"arn:aws:s3:::prod-bucket/folder1/folder2/*",
"arn:aws:s3:::prod-bucket/folder3/folder4/my_file.csv",
]
}
]
我能夠讀取 folder2 中的所有物件，但是在嘗試讀取 folder4 中的 my_file.csv 時，它無法獲取它。語法有問題嗎？我嘗試了多種方法，但無法弄清楚如何限制只能讀取特定檔案。
uj5u.com熱心網友回復：
如果您不知道如何撰寫，您可以使用 AWS Policy Generator，并且您可以擁有這樣的東西。
{
"Id": "VisualEditor0",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1634859177800",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::prod-bucket/folder3/folder4/my_file.csv",
"Principal": "*"
},
{
"Sid": "Stmt1634859274600",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::prod-bucket/folder1/folder2/*",
"Principal": "*"
}
]
}
uj5u.com熱心網友回復：
這個政策對我有用：
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "s3:GetObject",
"Effect": "Allow",
"Resource": "arn:aws:s3:::my-bucket/folder3/folder4/my_file.csv"
}
]
}
我將該策略放在 IAM User 上，然后使用 AWS CLI（作為該用戶）：
aws s3 cp s3://my-bucket/folder3/folder4/my_file.csv -
它成功地將我以該名稱上傳的檔案列印到我的螢屏上。（連字符將其發送到標準輸出。）
轉載請註明出處，本文鏈接：https://www.uj5u.com/shujuku/333202.html
上一篇：當我們將資料從加密的AWSS3存盤桶發送到加密的GoogleCloudStorage存盤桶時，該資料在傳輸程序中是否加密？