amazon-web-services - 2023年4月ACL限制后如何通过cloudformation设置BucketPolicy

Question

我正在关注 testdrive.io 的 serverless-fastapi 类(class)。它使用cloudformation来设置存储桶和存储桶策略。存储桶创建得很好，但是创建存储桶策略时出现问题。首先，由于 4 月份的新政策，我不得不注释掉 # AccessControl: PublicRead (请参阅 post )。但是，现在由于以下错误而失败:

API:s3:PutBucketPolicy 访问被拒绝

我正在通过 github 部署 serverless.yml 文件，并为 github 创建了一个具有以下权限的用户:AdministratorAccess

此存储桶应该向公众开放，因为它将托管前端 Vue Web 框架的文件。如何为此创建存储桶策略？

# serverless.yml 
service: tasks-ui

frameworkVersion: "3"
useDotenv: true

provider:
  name: aws
  region: ${opt:region, 'us-east-2'}
  stage: ${opt:stage, 'development'}

plugins:
  - serverless-s3-sync

custom:
  stage: ${opt:stage, self:provider.stage}
  bucketName: ${self:custom.stage}-tasks-api-mp
  s3Sync:
    # A simple configuration for copying static assets!
    - bucketName: ${self:custom.bucketName}
      localDir: dist

resources:
  Resources:
    TasksAPIBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.bucketName}
        # AccessControl: PublicRead
        WebsiteConfiguration:
          IndexDocument: index.html
          ErrorDocument: error.html
    TasksAPIBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: !Ref TasksAPIBucket
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: "PublicReadGetObject"
              Effect: "Allow"
              Principal: "*"
              Action: "s3:GetObject"
              Resource:
                Fn::Join:
                  - ""
                  - - "arn:aws:s3:::"
                    - !Ref TasksAPIBucket
                    - "/*"
  Outputs:
    TasksAPIBucketName:
      Value: !Ref TasksAPIBucket
      Export:
        Name: s3-${self:custom.bucketName}-name
    TasksAPIBucketArn:
      Value: !GetAtt TasksAPIBucket.Arn
      Export:
        Name: s3-${self:custom.bucketName}-arn

Answer 1

收到 s3:PutBucketPolicy Access Denied 错误通常表示:

• 您无权设置存储桶策略，或
• 存储桶已启用S3 阻止公共(public)访问

您的帐户可能默认启用了阻止公共(public)访问，因此每个新存储桶都会收到该设置。

来自AWS::S3::Bucket PublicAccessBlockConfiguration - AWS CloudFormation :

  BlockPublicAcls: Boolean
  BlockPublicPolicy: Boolean
  IgnorePublicAcls: Boolean
  RestrictPublicBuckets: Boolean

您想要更改引用存储桶策略的值。