amazon-web-services - AWS S3 : Setting a bucket policy for multiple users in an account

Question

我有一个 S3 存储桶。我在这个账户中有几个 IAM 用户。我想设置一个bucket policy，让多个用户可以访问这个 bucket。

对于单个用户的访问权限，我的存储桶策略如下所示:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::8474632:user/personA"
            },
            "Action": [
                "s3:getObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:getObjectAcl",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::thisbucket/*"
        }
    ]
}

我试图改变这一行:

“AWS”:“arn:aws:iam::8474632:user/personA”

到

“AWS”:“arn:aws:iam::8474632:user/*”

允许所有用户访问，但这不起作用。

我可以一一列出所有/一些用户:

  "Principal": {
    "AWS": ["arn:aws:iam::111122223333:user/PersonA",
            "arn:aws:iam::111122223333:user/PersonB"]
  },

是否有更好的方法允许一组用户或所有用户访问存储桶？

Answer 1

执行此操作的另一种方法可能是使用附加到所有用户的 IAM 策略。您可以创建如下策略:

    "Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:GetObjectVersion",
            "s3:GetObjectVersionAcl",
            "s3:GetObjectVersionTagging",
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:PutObjectVersionAcl"
        ],
        "Resource": [
            "arn:aws:s3:::bucket_name/*"
        ]
    }
]

然后将该策略添加到新角色，然后将该角色与您想要访问的用户相关联。