amazon-web-services - AccessDenied 根据策略无效 : Policy Condition failed: ["starts-with", "$key", "2017/"]

Question

我收到我在标题中指定的错误。

我尝试这样做:
使用 上传带有签名 URL 的对象php

问题在这里:['starts-with', '$key', 'test/']['starts-with', '$key', 'test/']这是如何运作的？

在存储桶测试文件夹中存在。

请帮忙。

我的代码(服务器端 php):

$formInputs = ['acl' => 'private'];

// Construct an array of conditions for policy $options = [
    ['acl' => 'private'],
    ['bucket' => $bucket],
    ['starts-with', '$key', 'test/'] ];

// Optional: configure expiration time string $expires = '+2 hours';

$postObject = new \Aws\S3\PostObjectV4(
    $client,
    $bucket,
    $formInputs,
    $options,
    $expires );

$formAttributes = $postObject->getFormAttributes(); $formInputs = $postObject->getFormInputs();

?>


----------


<form action="<?=$formAttributes['action']?>" method="<?=$formAttributes['method']?>" enctype="<?=$formAttributes['enctype']?>">

<?php

    foreach($formInputs as $k=>$v){
        echo'<input type="hidden" name="'.$k.'" value="'.$v.'" ><br>'."\r\n";
    }
    ?>
    <input type="file" name="file">
    <input type="submit" name="upload s3">
</form>

源代码

<form action="https://s3.amazonaws.com/my-bucket" method="POST" enctype="multipart/form-data">

<input type="hidden" name="acl" value="private" ><br>
<input type="hidden" name="key" value="${filename}" ><br>
<input type="hidden" name="X-Amz-Credential" value="AKIAJEEAQV5BBYRDKAFQ/20171222/us-east-1/s3/aws4_request" ><br>
<input type="hidden" name="X-Amz-Algorithm" value="AWS4-HMAC-SHA256" ><br>
<input type="hidden" name="X-Amz-Date" value="20171222T083752Z" ><br>
<input type="hidden" name="Policy" value="eyJleHBpcmF0aW9uIjoiMjAxNy0xMi0yMlQxMDozNzo1MloiLCJjb25kaXRpb25zIjpbeyJhY2wiOiJwcml2YXRlIn0seyJidWNrZXQiOiIzZG1mcmVlLmNvbSJ9LFsic3RhcnRzLXdpdGgiLCIka2V5IiwiXC8yMDE3XC8iXSx7IlgtQW16LURhdGUiOiIyMDE3MTIyMlQwODM3NTJaIn0seyJYLUFtei1DcmVkZW50aWFsIjoiQUtJQUpFRUFRVjVCQllSREtBRlFcLzIwMTcxMjIyXC91cy1lYXN0LTFcL3MzXC9hd3M0X3JlcXVlc3QifSx7IlgtQW16LUFsZ29yaXRobSI6IkFXUzQtSE1BQy1TSEEyNTYifV19" ><br>
<input type="hidden" name="X-Amz-Signature" value="a47bd97c1e4313b8d9d798dd8e8ccd030102cf80e2e1dd2c12843db2645ec158" ><br>
    <input type="file" name="file">
    <input type="submit" name="upload s3">
</form>

错误

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<Error>
<Code>AccessDenied</Code>
<Message>
Invalid according to Policy: Policy Condition failed: ["starts-with", "$key", "test/"]
</Message>
<RequestId>E51EC9537EC2A4E9</RequestId>
<HostId>
+XgLNTFKCC4pMbq6lTXvePDyLRp6oG1O4SXh6hgtXXDNXJgbljcDLSXu2x35A6YFBue1aD/qACI=
</HostId>
</Error>

我的 CORS 配置

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
    <AllowedOrigin>*</AllowedOrigin>
    <AllowedMethod>POST</AllowedMethod>
    <AllowedMethod>GET</AllowedMethod>
    <AllowedMethod>PUT</AllowedMethod>
    <AllowedMethod>DELETE</AllowedMethod>
    <AllowedMethod>HEAD</AllowedMethod>
    <AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>

Answer 1

我解决了。

https://www.spacevatican.org/2013/7/7/direct-to-s3-browser-uploads/

占位符
您可能期望 {key: 'prefix/${filename}'} 的条件与具有值 prefix/${filename} 的键结合使用时会起作用。但是，要使其正常工作，您实际上需要具备 ['starts-with','$key', 'prefix/'] 的条件