S3 TVM问题-拒绝访问

Question

我试图让我的iOS应用程序上传到S3，使用它从一个稍微修改过的匿名令牌自动贩卖机获得的凭据。

我的令牌自动售货机返回的策略声明是：

{"Statement":
    [
        {"Effect":"Allow",
         "Action":"s3:*",
         "Resource":"arn:aws:s3:::my-bucket-test",
         "Condition": {
            "StringLike": {
                "s3:prefix": "66-*"
            }
         }
        },
        {"Effect":"Deny","Action":"sdb:*","Resource":["arn:aws:sdb:us-east-1:MYACCOUNTIDHERE:domain/__USERS_DOMAIN__","arn:aws:sdb:us-east-1:MYACCOUNTIDHERE:domain/TokenVendingMachine_DEVICES"]},
        {"Effect":"Deny","Action":"iam:*","Resource":"*"}
    ]
}

我试图放置的对象具有相同的桶名和键66-3315F11E-84FA-417F-9C32-AC4BE364AD99.natural.mp4。

据我所知，这应该是很好的，但它没有，并抛出访问拒绝消息。我的政策声明有什么问题吗？

Answer 1

您不需要使用前缀来引用对象操作上下文的资源。我还建议限制S3操作。下面是一个基于S3个人文件存储库文章中的推荐策略。如果ListBucket对你的应用没有意义，请随时删除它。

{"Statement":
    [
        {"Effect":"Allow",
         "Action":["s3:PutObject","s3:GetObject","s3:DeleteObject"],
         "Resource":"arn:aws:s3:::my-bucket-test/66-*",
        },
        {"Effect":"Allow",
         "Action":"s3:ListBucket",
         "Resource":"arn:aws:s3:::my-bucket-test",
         "Condition":{
              "StringLike":{
                   "s3:prefix":"66-*"
              }
         }
        },  
        {"Effect":"Deny","Action":"sdb:*","Resource":["arn:aws:sdb:us-east-1:MYACCOUNTIDHERE:domain/__USERS_DOMAIN__","arn:aws:sdb:us-east-1:MYACCOUNTIDHERE:domain/TokenVendingMachine_DEVICES"]},
        {"Effect":"Deny","Action":"iam:*","Resource":"*"}
    ]
 }