指定主体时 S3 访问被拒绝

Question

存储桶策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::123456784337:root",
                    "arn:aws:iam::123456784337:user/lambda-user"
                ]
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucket/*"
        }
    ]
   }

初始化

 AWS.config.update({
      region: 'ap-southeast-1',
      accessKey: 'abcxxxx',
      secretAccessKey:'abcdxxx'

    });
    AWS.config.credentials = new AWS.CognitoIdentityCredentials({
     IdentityPoolId: 'ap-southeast-1:12340000-5587-4d40-91fe-9fab5668c708'
    });

S3 获取对象

function (bucketName, key) {
  const params = {
    Bucket: bucketName,
    Key: key,
  };
  return s3.getObject(params).promise()
    .then((data) => {
      console.log('Successfully read from S3!');
      return data;
    });
};

Connito 用户未认证

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "lambda:InvokeFunction",
                "mobileanalytics:PutEvents",
                "dynamodb:Scan",
                "lambda:InvokeAsync",
                "cognito-sync:*"
            ],
            "Resource": "*"
        }
    ]
}

未能读取到 S3。 AccessDenied：拒绝访问 （节点：73168）UnhandledPromiseRejectionWarning：未处理的承诺拒绝（拒绝 id：1）：AccessDenied：访问被拒绝

仅当 Principal 为通配符时才有效，但不建议使用该配置。

Answer 1

这是从 S3 读取文件的策略。

{
    "Id": "Policy1528709447655",
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "Stmt1528709412334",
        "Action": [
            "s3:GetBucketPolicy",
            "s3:GetObject",
            "s3:GetObjectTagging",
            "s3:GetObjectAcl"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::bucket_name",
            "arn:aws:s3:::bucket_name/*"
        ],
        "Principal": {
            "AWS": [
                "arn:aws:iam::123456784337:root",
                "arn:aws:iam::487686674337:user/lambda-user"
            ]
        }
    }]
}