amazon-web-services - CloudFormation、S3 存储桶访问跨账户 IAM 角色

Question

我有 2 个帐户:s3_buck_acct 和 iam_acct。我想将 iam_acct 中的 IAM 角色配置为 s3_buck_acct 中 S3 存储桶上的某些操作。

这是我想出的 CloudFormation 模板，但最终出现错误:

Resources:
  S3BucketTest:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: "cross-acct-permission-demo"
      LifecycleConfiguration:
        Rules:
        - Id: LifecycleExpRule 
          ExpirationInDays: '3650'
          Status: Enabled
      BucketEncryption: 
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  S3CURBucketPolicy: 
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: 
        !Ref S3BucketTest
      PolicyDocument: 
        Statement: 
          - Action:
                - 's3:ListBucket'
                - 's3:ListBucketMultipartUploads'
                - 's3:PutObject'
                - 's3:GetObject'
            Effect: "Allow"
            Resource: 
              - "arn:aws:s3:::cross-acct-perm-demo"
              - "arn:aws:s3:::cross-acct-perm-demo/*"
            Principal: "arn:aws:iam::1234567890:role/service-role/test-role-20190828T130835"
          - Action: "*"
            Resource: !Join [ '', ["arn:aws:s3:::", !Ref S3BucketTest, '/*']]
            Principal: '*'
            Effect: Deny
            Condition:
              Bool:
                'aws:SecureTransport':
                  - 'false'

错误消息:

Invalid policy syntax. (Service: Amazon S3; Status Code: 400; Error Code: MalformedPolicy; Request ID: 91BF8921047D9D3B; S3 Extended Request ID: ZOVOzmFZYN6yB1btOqMqgJjOpzfiUpP86c2XiVylzYkg37fGga8/eYDL7C4WzwhmcDGU7NJkL68=)

不知道我哪里弄错了。我可以为跨账户 IAM 配置 S3 存储桶访问权限吗？从控制台权限部分，我能够做到这一点。

Answer 1

您的存储桶名为 cross-acct-permission-demo，但您的策略指定了 cross-acct-perm-demo。此外，您的第一个 Action 缩进不正确(尽管它不应该导致此问题)。也不确定 service-role 原则在这种情况下是否正确。