使用 cloudformation 模板授予对 s3 存储桶对象的公共读取和查看访问权限

Question

我正在编写一个 AWS cloudformation 模板来接收来自 Kinesis Firehose 的 s3 存储桶中的文件。我已授予对存储桶的公共读取访问权限（存储桶是公共的），但是当我使用对象 URL 访问存储桶内的文件时，我收到“XML 文件似乎没有与之关联的任何样式”错误，它说访问被拒绝.但是该对象（JSON 文件）是可下载的。

我已授予对 s3 存储桶的完全访问权限

Resources:

# Create s3 bucket
MyS3Bucket:
 Type: AWS::S3::Bucket
 Properties:
    BucketName: health-app-buckett
    AccessControl: PublicRead

# Create Role
S3BucketRole:
 Type: 'AWS::IAM::Role'
 Properties:
  AssumeRolePolicyDocument:
    Statement:
      - Effect: Allow
        Principal:
          Service:
            - s3.amazonaws.com
        Action:
          - 'sts:AssumeRole'

#Create policy for bucket
S3BucketPolicies:
 Type: 'AWS::IAM::Policy'
 Properties:
  PolicyName: S3BucketPolicy
  PolicyDocument:
    Statement:
      - Sid: PublicReadForGetBucketObjects
        Effect: Allow
        Action: 's3:GetObject'
        Resource: !Join
          - ''
          - - 'arn:aws:s3:::'
            - !Ref MyS3Bucket
            - /*
  Roles:
    - !Ref S3BucketRole

我希望能够使用对象 URL 查看文件

Answer 1

您需要将 PublicAccessBlockConfiguration 添加到您的模板中

MyS3Bucket:
 Type: AWS::S3::Bucket
 Properties:
    BucketName: health-app-buckett
    AccessControl: PublicRead
    PublicAccessBlockConfiguration:
            BlockPublicAcls : false
            BlockPublicPolicy : false
            IgnorePublicAcls : false
            RestrictPublicBuckets : false