amazon-web-services - S3 是否提供任何存储桶策略以在有限的时间内将对象共享给 IAM 用户？

Question

我想在有限的时间内与 IAM 用户 (testuser) 共享我的存储桶 (sourcebucket)。 AWS 是否提供任何存储桶策略以便我可以在有限的时间范围内与 IAM 用户共享我的存储桶对象？

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateS3Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::12345678910:user/testuser"
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucket/*",
                "arn:aws:s3:::sourcebucket"
            ]
        }
    ]
}

Answer 1

Does AWS provide any bucket policy so that I can share my bucket objects with the IAM User for a limited time frame?

是的。

检查 DateGreaterThan 和 DateLessThan 条件以及 aws:CurrentTime 条件键。这是一个示例，使用您问题中的政策作为基础:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "DelegateS3Access",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::12345678910:user/testuser"
        },
        "Action": [
            "s3:ListBucket",
            "s3:GetObject"
        ],
        "Resource": [
            "arn:aws:s3:::sourcebucket/*",
            "arn:aws:s3:::sourcebucket"
        ],
        "Condition": {
            "DateGreaterThan": {"aws:CurrentTime": "2020-04-01T00:00:00Z"},
            "DateLessThan": {"aws:CurrentTime": "2020-06-30T23:59:59Z"}
        }
    }
]
}

这里有一些有用的链接:

• AWS Global Condition Context Keys: aws:CurrentTime

• AWS: Allows Access Within Specific Dates