amazon-s3 - 如何创建具有公共(public)读取访问权限的存储桶？

Question

我想对我的 Bucket 中 serverless.yml 文件的“public”文件夹中的所有项目启用公共(public)读取访问权限。

目前这是我用来声明我的存储桶的定义代码。它是从一个无服务器堆栈示例中复制和粘贴的。

Resources:
  AttachmentsBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      # Set the CORS policy
      BucketName: range-picker-bucket-${self:custom.stage}
      CorsConfiguration:
        CorsRules:
          -
            AllowedOrigins:
              - '*'
            AllowedHeaders:
              - '*'
            AllowedMethods:
              - GET
              - PUT
              - POST
              - DELETE
              - HEAD
            MaxAge: 3000

# Print out the name of the bucket that is created
Outputs:
  AttachmentsBucketName:
    Value:
      Ref: AttachmentsBucket

现在，当我尝试对文件使用 url 时，它返回访问被拒绝。我必须在 aws-s3 Web 界面中手动设置每个文件的公共(public)读取权限。

我究竟做错了什么？

Answer 1

而不是使用 CorsConfiguration在桶上，您需要 attach a bucket policy给它。尝试以下操作:

Resources:
  AttachmentsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: range-picker-bucket-${self:custom.stage}

  AttachmentsBucketAllowPublicReadPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref AttachmentsBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement: 
          - Effect: Allow
            Action: 
              - "s3:GetObject"
            Resource: 
              - !Join ['/', [!Ref AttachmentsBucket, 'public']]
            Principal: "*"