php - AWS 使用 StsClient 限制对临时凭证 getSessionToken 的访问

问题描述

商业年鉴

有多个办事处拥有自己的 AWS S3 存储桶。一个办公室的任何用户都无法访问另一个办公室的 S3 存储桶。

因此，对于每个办公室，都有一个S3 Bucket和一个IAM user。每个 IAM 用户只有一个存储桶的权限。由于办公室不经常增长，IAM 用户创建和分配权限是通过手动完成的AWS Console。

应用场景

浏览器 (Javascript) 要求服务器 (PHP API) 提供临时凭证以将文件上传到AWS S3. PHP API 获取Access key ID和Secret access key从数据库（基于登录的办公室）。然后使用AWS PHP SDK，调用StsClient和使用getSessionToken()方法来获取临时凭证并将其传递给Javascript。

PHP 代码

use Aws\Sts\StsClient;
$credentials = new Aws\Credentials\Credentials($resultset['awssecret'], $resultset['awspass']);

$stsoptions = [
  'region'            => 'ap-south-1',
  'version'           => '2011-06-15',
  'signature_version' => 'v4',
  'credentials'       => $credentials,
];

$stsClient = new StsClient($stsoptions);
$response = $stsClient->getSessionToken();

问题

目前，IAM 用户拥有对相应存储桶的完全访问权限。我想将临时凭证访问限制为仅某些授权。像只允许上传，不能删除文件或列出所有文件。

我可以将其他参数传递给StsClient可以限制对存储桶的权限的位置吗？

编辑 1

通过策略为用户分配权限。以下是添加到策略的权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucketByTags",
                "s3:GetBucketTagging",
                "s3:DeleteObjectVersion",
                "s3:GetObjectVersionTagging",
                "s3:ListBucketVersions",
                "s3:GetBucketLogging",
                "s3:RestoreObject",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetObjectAcl",
                "s3:AbortMultipartUpload",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "s3:PutObjectTagging",
                "s3:DeleteObject",
                "s3:PutBucketVersioning",
                "s3:GetIpConfiguration",
                "s3:DeleteObjectTagging",
                "s3:ListBucketMultipartUploads",
                "s3:GetBucketWebsite",
                "s3:PutObjectVersionTagging",
                "s3:DeleteObjectVersionTagging",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetBucketCORS",
                "s3:GetAnalyticsConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:GetBucketLocation",
                "s3:ReplicateDelete",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::aws:s3:::mybucket",
                "arn:aws:s3:::*/*"
            ]
        }
    ]
}

我的解决方案基于 Accepted Answer 建议的答案。

根据回答中的建议，添加了权限

 {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "*"
 }

现在我的 PHP 代码是

$policy = '{
  "Id": "Policy1534086947311",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1534086676951",
      "Action": [
        "s3:PutObject",
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::mybucket"
      }
    }
  ]
}';

$awsrole = [
  'Policy' => $policy,
  'RoleArn' => 'arn:aws:s3:::mybucket',
  'RoleSessionName' => 'credApi' // just a random value
];
$response = $stsClient->assumeRole($awsrole);

标签： phpamazon-web-servicesamazon-s3amazon-iamaws-sts

php - AWS 使用 StsClient 限制对临时凭证 getSessionToken 的访问

问题描述

商业年鉴

应用场景

问题

解决方案

推荐阅读