为什么我从 S3 DeleteObjects 收到“AccessDenied”？

Question

我正在尝试像这样（Lambda / Node.js）删除 S3 存储桶中的多个对象：

exports.handler =  async function(event, context) {
  const s3Params = {
    Bucket: 'my-bucket',
    Delete: {
      Objects: [ 'my-bucket/dir/file1.json', 'my-bucket/dir/file2.json' ],
      Quiet: False
    }
  }
  const result = await s3.deleteObjects(s3Params).promise()
  return result
}

但我明白了：

{ 
  result: { 
    Deleted: [],
    Errors: [ 
        {Key: "my-bucket/dir/file1.json", Code: "AccessDenied", Message: "Access Denied"},
        {Key: "my-bucket/dir/file1.json", Code: "AccessDenied", Message: "Access Denied"}
    ]
  }
}  

这是我的角色政策：

{
    "RoleName": "S3CleanupRole", 
    "PolicyDocument": {
        "Version": "2012-10-17", 
        "Statement": [
            {
                "Action": [
                    "s3:ListBucket", 
                    "s3:DeleteObject"
                ], 
                "Resource": [
                    "arn:aws:s3:::my-bucket"
                ], 
                "Effect": "Allow"
            }, 
            {
                "Action": [
                    "DynamoDB:Query"
                ], 
                "Resource": [
                    "arn:aws:dynamodb:us-east-1:514141358776:table/buckets-to-clean-out"
                ], 
                "Effect": "Allow"
            }
        ]
    }, 
    "PolicyName": "S3CleanupPolicy"
}

有什么问题？

Answer 1

（为此感谢Ravi Ramanujam - 他对AWS S3 Access Denied on delete 的回答帮助我解决了这个问题。）

我的政策是错误的。 s3:DeleteObject 的权限仅适用于存储桶 arn:aws:dynamodb:us-east-1:514141358776:table/buckets-to-clean-out，不 其任何内容。正确的策略允许 s3:DeleteObject 存储桶内容，即：

{
    "RoleName": "S3CleanupRole", 
    "PolicyDocument": {
        "Version": "2012-10-17", 
        "Statement": [
            {
                "Action": [
                    "s3:ListBucket"
                ], 
                "Resource": [
                    "arn:aws:s3:::my-bucket"
                ], 
                "Effect": "Allow"
            }, 
            {
                "Action": [
                    "s3:DeleteObject"
                ], 
                "Resource": [
                    "arn:aws:s3:::my-bucket/*"
                ], 
                "Effect": "Allow"
            }, 
            {
                "Action": [
                    "DynamoDB:Query"
                ], 
                "Resource": [
                     "arn:aws:dynamodb:us-east-1:514141358776:table/buckets-to-clean-out"
                ], 
                "Effect": "Allow"
            }
        ]
    }, 
    "PolicyName": "S3CleanupPolicy"
}

关键部分如下。请注意，“资源”部分包含 arn:aws:s3:::my-bucket/* 而不仅仅是 arn:aws:s3:::my-bucket

 {
     "Action": [
         "s3:DeleteObject"
     ], 
     "Resource": [
          "arn:aws:s3:::my-bucket/*"
     ], 
     "Effect": "Allow"
 }