如何为云模板中的桶编写策略

Question

我已经准备了一个云模板，它用AWS::IAM::Role策略创建了arn:aws:iam::aws:policy/AmazonS3FullAccess。

在模板成功运行之后，我执行一个python脚本来创建两个前缀为foobar-bucket1和foobar-bucket2的桶。

目前，我的模板的上述部分是这样的：

Resources:
  MyRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ssm.amazonaws.com
            - ec2.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Path: "/"

问题

我想知道是否需要通过云模板创建的IAM::Role拥有AmazonS3FullAccess来创建这两个桶？

我是否可以只授予角色创建桶的权限，然后只在前缀为foobar-bucket1和foobar-bucket2的存储桶上授予foobar-bucket1权限。

Answer 1

只要桶名是动态的，您就不能在cloudformation模板中创建包含正确名称的策略。

按实用性的递减顺序：

选项1:在cloudformation模板中创建桶，然后在该模板中相应地创建IAM角色(参见下面的示例)。

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  foobarBucket1:
    Type: AWS::S3::Bucket
  foobarBucket2:
    Type: AWS::S3::Bucket
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: LambdaRolePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - s3:DeleteObject
              - s3:GetObject
              - s3:PutObject
              Resource: !Join ['', ['arn:aws:s3:::', !Ref foobarBucket1 ]]
            - Effect: Allow
              Action:
              - s3:DeleteObject
              - s3:GetObject
              - s3:PutObject
              Resource: !Join ['', ['arn:aws:s3:::', !Ref foobarBucket2 ]]

选项2:另一种可能是将固定前缀合并到策略中，从而部分限制访问。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::foobarbucket1-*",
            "Effect": "Allow"
        }
    ]
}

选项3:使用桶名作为cloudformation参数，并使用新创建的名称更新现有模板。