python - 使用 boto 库，我可以避免在 S3 中的基本存储桶上授予列表权限吗？

Question

我目前有一个 IAM 角色，其政策如下:

{
  "Version":"2008-10-17",
  "Statement": [
  {
    "Effect":"Allow",
    "Action":["s3:ListBucket"],
    "Resource":[
      "arn:aws:s3:::blah.example.com"
    ]
  },
  {
    "Effect":"Allow",
    "Action":["s3:GetObject", "s3:GetObjectAcl", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject"],
    "Resource":[
      "arn:aws:s3:::blah.example.com/prefix/"
    ]
  }
  ]
}

Boto 似乎需要 ListBucket 权限出现在存储桶的根上才能执行 get_bucket 调用。如果我删除语句数组中的第一个散列，get_bucket('blah.example.com') 将失败。这是错误文本:

*** S3ResponseError: S3ResponseError: 403 Forbidden<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>xxxx</RequestId><HostId>yyyy</HostId></Error>

Is there any way to restrict listing of the bucket to a certain prefix (e.g. "prefix/") while still using boto?

UPDATE

In order to get everything working, I used the following policy:

{
  "Version":"2008-10-17",
  "Statement": [
  {
    "Effect":"Allow",
    "Action":["s3:ListBucket"],
    "Resource":[
      "arn:aws:s3:::blah.example.com"
    ],
    "Condition":{
      "StringLike":{
         "s3:prefix":"prefix/*"
      }
    }
  },
  {
    "Effect":"Allow",
    "Action":["s3:GetObject", "s3:GetObjectAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:DeleteObject"],
    "Resource":[
      "arn:aws:s3:::blah.example.com/prefix/*"
    ]
  }
  ]
}

您仍然需要对 get_bucket 方法使用 validate=False 参数，但它允许在前缀内列出。

Answer 1

默认情况下，boto 会尝试通过对存储桶执行 LIST 操作来验证存储桶的存在，并询问零结果。如果您希望它跳过此验证步骤，只需这样调用它:

>>> import boto
>>> s3 = boto.connect_s3()
>>> bucket = s3.get_bucket('mybucket', validate=False)

这应该跳过 LIST 操作。