amazon-s3 - 使用 AWS IAM 角色和策略访问具有特定 "tag"的 s3

Question

我想创建一个 AWS IAM 策略，这样附加的角色应该可以访问所有具有标签“Team = devops”的 S3 存储桶。我尝试了以下 JSON 文件，但它不起作用。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "arn:aws:s3:::*",
            "Condition": {
                "StringEquals": {"s3:ResourceTag/Team": "devops"}
            }
        }
    ]
}

Answer 1

根据 Available Condition Keys , s3:ResourceTag 不适用于 S3 条件。

The predefined keys available for specifying conditions in an Amazon S3 access policy can be classified as follows:

如 Object Tagging and Access Control Policies ，可以使用 来控制每个对象的访问权限s3:ExistingObjectTag 条件键。

The following permissions policy grants a user permission to read objects, but the condition limits the read permission to only objects that have the following specific tag key and value.

security : public

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect":     "Allow",
      "Action":     "s3:GetObject",
      "Resource":    "arn:aws:s3:::examplebucket/*",
      "Principal":   "*",
      "Condition": {  "StringEquals": {"s3:ExistingObjectTag/security": "public" } }
    }
  ]
}