amazon-s3 - Coudfront OAI 集拥有但允许其他 AWS 账户上传 s3 对象的 S3 的存储桶策略应该是什么

Question

我有 S3，它限制了提供私人内容的政策。只有 Cloudfront Origin Access Identity 可以访问。但是，应该允许其他帐户上传新对象，以便客户可以获得新资产。针对这种情况应该制定什么样的政策？

目前我的政策是这样的

          {
                "Sid": "1",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity SomeID12334"
                },
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::my-bucket/*"
            }

标签： amazon-s3amazon-cloudfront

Answer 1

您可以在存储桶策略中添加多个语句来处理权限。提供来自另一个账户的角色 ARN，以提供对存储桶执行特定操作的访问权限。

     {
         "Sid": "1",
         "Effect": "Allow",
         "Principal": {
             "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity SomeID12334"
            },
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
        "Sid": "Stmt1570159952662",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::<accountno>:role/rolename"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::my-bucket"
    }