amazon s3的官方有一篇介绍文章,但是少了一个”,”,导致并不能成功导入。
amazon有提供policy的在线生成工具,地址是http://awspolicygen.s3.amazonaws.com/policygen.html
amazon针对用户共用bucket,指定用户目录的policy在https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/
具体policy可以使用下方的policy
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AllowGroupToSeeBucketListInTheConsole",
"Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::*"]
},
{
"Sid": "AllowRootAnd<shared-folder-name>ListingOfCompanyBucket",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::<bucket-name>"],
"Condition":{"StringEquals":{"s3:prefix":["","<shared-folder-name>/"],"s3:delimiter":["/"]}}
},
{
"Sid": "AllowListingOfUserFolder",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::<bucket-name>"],
"Condition":{"StringLike":{"s3:prefix":
[
"<shared-folder-name>/${aws:username}/*",
"<shared-folder-name>/${aws:username}"
]
}
}
},
{
"Sid": "AllowAllS3ActionsInUserFolder",
"Action":["s3:*"],
"Effect":"Allow",
"Resource": ["arn:aws:s3:::<bucket-name>/<shared-folder-name>/${aws:username}/*"]
}
]
}
但是其实只保留最后两段是比较安全的,这样子无论是/根目录还是<shared-folder-name>共享目录都是不可以list的,只能list用户自己的名字命名的文件夹。
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AllowListingOfUserFolder",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::<bucket-name>"],
"Condition":{"StringLike":{"s3:prefix":
[
"<shared-folder-name>/${aws:username}/*",
"<shared-folder-name>/${aws:username}"
]
}
}
},
{
"Sid": "AllowAllS3ActionsInUserFolder",
"Action":["s3:*"],
"Effect":"Allow",
"Resource": ["arn:aws:s3:::<bucket-name>/<shared-folder-name>/${aws:username}/*"]
}
]
}
这样子可以非常安全的隔离用户,也不用为每个用户建立一个bucket桶,还是很方便的。经过奶牛的测试,ACL最好就用默认的private,这样子安全性会更高。