amazon-web-services - AWS - 为无服务器创建策略，但不授予查看其他存储桶文件的权限

Question

我正在编写一个使用无服务器部署我的应用程序的策略。一切正常，直到有要求禁止使用此策略查看另一个存储桶中的文件。

目前，这是我的策略，我只授予用户查看特定存储桶中文件的权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "cloudformation:ListStacks",
                "cloudformation:UpdateStackInstances",
                "cloudformation:DescribeStackInstance",
                "cloudformation:ListStackInstances",
                "cloudformation:DescribeStackResources",
                "s3:CreateBucket",
                "s3:ListBucket",
                "s3:PutObject",
                "cloudformation:DescribeStackResource",
                "cloudformation:UpdateStackSet",
                "cloudfront:CreateInvalidation",
                "cloudformation:CreateStackInstances",
                "cloudformation:DescribeStacks",
                "apigateway:DELETE",
                "cloudformation:DescribeStackEvents",
                "cloudformation:CreateStack",
                "cloudformation:UpdateStack",
                "apigateway:POST",
                "cloudformation:ValidateTemplate",
                "cloudformation:ListStackResources"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "lambda:UpdateFunctionCode",
                "lambda:ListVersionsByFunction",
                "lambda:ListAliases",
                "lambda:DeleteFunction",
                "lambda:PublishVersion",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:lambda:ap-northeast-1:xxxxxxx:function:noe-denki-api-test1",
                "arn:aws:lambda:ap-northeast-1:xxxxxxx:function:noe-denki-api-test2",
                "arn:aws:s3:::s3-front-app/*"
            ]
        }
    ]
}

当我跑步时。出现这样的错误：

如果我将 S3:GetObject 的资源更改为* ，它工作正常。但是现在用户可以查看其他存储桶中的文件.. 我应该怎么做才能做到这一点？

标签： amazon-web-servicesamazon-s3policy