amazon-web-services - 跨账户中的 Amazon S3 文件 'Access Denied' 异常

Question

我有 2 个 AWS 账户。帐户 A 有 S3 存储桶“BUCKET”，我使用 Java api 在其中放置了文件。我已将我的“BUCKET”策略配置为允许跨账户文件发布。
但是，当我尝试从帐户 A 打开此文件时，它显示 AccessDenied使用 hostId 和 requestId 拒绝访问。

该文件是通过账户B使用java api发布的，该文件与通过api发布的文件大小相同。我尝试更改文件大小，新大小显示在 AWS S3 控制台上。
这是我的存储桶策略:

    {
"Version": "2008-10-17",
"Id": "Policy1357935677554",
"Statement": [
    {
        "Sid": "Stmt1357935647218",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTB:user/accountb-user"
        },
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::bucket-name"
    },
    {
        "Sid": "Stmt1357935676138",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTB:user/accountb-user"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::bucket-name/*"
    },
    {
        "Sid": "Stmt1357935676138",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTB:user/accountb-user"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::bucket-name/*"
    },
    {
        "Sid": "Stmt1357935647218",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTA:user/accounta-user"
        },
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::bucket-name"
    },
    {
        "Sid": "Stmt1357935676138",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTA:user/accounta-user"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::bucket-name/*"
    },
    {
        "Sid": "Stmt1357935676138",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTA:root"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::bucket-name/*"
    }
]

}

问题是当我尝试从帐户 A 下载/打开此文件时，我无法打开它。

Answer 1

问题是，默认情况下，当 AWS(cli 或 SDK)上传文件时，它仅通过 s3 授予对上传者的访问权限。 ACL。

在这种情况下，为了允许所有者读取上传的文件，上传者必须在上传过程中明确授予存储桶所有者的访问权限。前任:

与 aws CLI(文档 here):aws s3api put-object --bucket <bucketname> --key <filename> --acl bucket-owner-full-control

与 nodejs API(文档 here):您必须设置 params.ACL AWS.S3.upload 的属性(property)方法到 "bucket-owner-full-control"

同时，您还可以确保存储桶所有者对存储桶策略具有完全控制权(附加文档 here):
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Grant Owner Full control dev",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::ACCOUNTB:root"
},
"Action": [
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::bucket-name/*"
],
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}