I am trying to deploy a static website using an S3 bucket with Terraform.
我正在尝试使用带有Terraform的S3存储桶部署一个静态网站。
Therefore I need to use the a aws_s3_bucket_policy
resource:
因此,我需要使用a AWS_S3_Bucket_POLICY资源:
resource "aws_s3_bucket_policy" "bucket" {
bucket = aws_s3_bucket.bucket.id
policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "PublicReadGetObject"
Effect = "Allow"
Principal = "*"
Action = "s3:GetObject"
Resource = [
aws_s3_bucket.bucket.arn,
"${aws_s3_bucket.bucket.arn}/*",
]
},
]
})
}
When I try to deploy this I get the following error:
当我尝试部署它时,我收到以下错误:
Error: putting S3 policy: AccessDenied: Access Denied
错误:放置S3策略:访问被拒绝:访问被拒绝
更多回答
Looks like you the credentials you are using do not have sufficient permissions
看起来您使用的凭据没有足够的权限
I double checked the permissions. To make sure everything works I tried a run using a user with admin principles.
我仔细检查了权限。为了确保一切正常运行,我尝试使用具有管理员原则的用户运行。
优秀答案推荐
since the s3 bucket exists already, the PutBucketPolicy needs to be assigned for the user or role being used:
由于S3存储桶已经存在,因此需要为正在使用的用户或角色分配PutBucketPolicy:
- in iam: add a policy that grants the appropriate permissions for the user or role being used.
- s3 bucket policy: add a policy that grants the appropriate permissions for the user or role being used.
the 2nd item isn't needed unless the bucket policy restricts bucket policy updates.
除非存储桶策略限制存储桶策略更新,否则不需要第二项。
if you can view the bucket policy, you can see who has the appropriate permissions to update the bucket policy. if not active user or role has access to update the bucket policy, you'll need to use the aws account root user to update the bucket policy to grant an active user the update the bucket policy.
如果您可以查看存储桶策略,就可以看到谁有相应的权限更新存储桶策略。如果非活动用户或角色有权更新存储桶策略,您将需要使用AWS帐户根用户更新存储桶策略,以授予活动用户更新存储桶策略的权限。
AWS has changed default permissions for new buckets in April this year. Since then public access is fully restricted by default, so you are not able to put your access policy without enabling proper option. You can try to use this Terraform resource, to unblock public policies:
AWS已于今年4月更改了新存储桶的默认权限。因为在默认情况下,公共访问是完全受限的,所以在没有启用适当选项的情况下,您无法放置您的访问策略。您可以尝试使用此Terraform资源来取消阻止公共策略:
resource "aws_s3_bucket" "example" {
bucket = "example"
}
resource "aws_s3_bucket_public_access_block" "example" {
bucket = aws_s3_bucket.example.id
block_public_policy = false // This is default, so you can probably remove this line
restrict_public_buckets = false // same as above
block_public_acls = true
ignore_public_acls = true
}
This will probably overwrite default bucket settings. I think that you will also need to use depends_on = [ aws_s3_bucket_public_access_block.example ]
in policy resource to make sure that those options will be changed before terraform attach policy to bucket.
这可能会覆盖默认存储桶设置。我认为您还需要在策略资源中使用Depends_on=[AWS_S3_Bucket_PUBLIC_ACCESS_BLOCK.Example],以确保在Terraform将策略附加到存储桶之前更改这些选项。
更多回答
我是一名优秀的程序员,十分优秀!