结合静态网站的两个 s3 策略

Question

我有 S3 静态网站托管内部网站。我找到了 aws 提供的政策文件，它将提供对 public 的只读访问权限，并且我有一个政策允许 S3 网站访问特定的 IP。当我合并时，我收到无效的政策文档错误。

        {
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "DenyPublicReadACL",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": [
                    "public-read",
                    "public-read-write",
                    "authenticated-read"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicReadGrant",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition": {
            "StringLike": {
                "s3:x-amz-grant-read": [
                    "*http://acs.amazonaws.com/groups/global/AllUsers*",
                    "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicListACL",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:PutBucketAcl",
        "Resource": "arn:aws:s3:::Examplebucket",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": [
                    "public-read",
                    "public-read-write",
                    "authenticated-read"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicListGrant",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:PutBucketAcl",
        "Resource": "arn:aws:s3:::Examplebucket",
        "Condition": {
            "StringLike": {
                "s3:x-amz-grant-read": [
                    "*http://acs.amazonaws.com/groups/global/AllUsers*",
                    "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
                ]
            }
        }
    }
]

}

    {
    "Version": "2012-10-17",
     "Id": "S3PolicyIPRestrict",
      "Statement": [
    {
        "Sid": "IPAllow",
        "Effect": "Allow",
        "Principal": {
            "AWS": "*" 
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition" : {
            "IpAddress" : {
                "aws:SourceIp": "192.168.143.0/24" 
            },
            "NotIpAddress" : {
                "aws:SourceIp": "192.168.143.188/32" 
            } 
        } 
       } 
      ]
       }

结合两个政策声明给出无效的政策声明

Answer 1

如果您希望每个人都能够从某个IP访问您的网站和完整的bucket访问，这里是一个例子：

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "PublicReadGetObject",
         "Effect": "Allow",
         "Principal": "*",
         "Action": [
            "s3:GetObject"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*"
      },
      {
         "Sid": "IPAllowFullAccess",
         "Effect": "Allow",
         "Principal": "*",
         "Action": "s3:*",
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "IpAddress": {
               "aws:SourceIp": "192.168.143.0/24"
            }
         }
      }
   ]
}

关于您关于组合策略的问题：您不能添加两个策略，但可以组合多个语句。一个示例只是为了说明如何组合策略：

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "DenyPublicReadACL",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "StringEquals": {
               "s3:x-amz-acl": [
                  "public-read",
                  "public-read-write",
                  "authenticated-read"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicReadGrant",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "StringLike": {
               "s3:x-amz-grant-read": [
                  "*http://acs.amazonaws.com/groups/global/AllUsers*",
                  "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicListACL",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:PutBucketAcl",
         "Resource": "arn:aws:s3:::Examplebucket",
         "Condition": {
            "StringEquals": {
               "s3:x-amz-acl": [
                  "public-read",
                  "public-read-write",
                  "authenticated-read"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicListGrant",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:PutBucketAcl",
         "Resource": "arn:aws:s3:::Examplebucket",
         "Condition": {
            "StringLike": {
               "s3:x-amz-grant-read": [
                  "*http://acs.amazonaws.com/groups/global/AllUsers*",
                  "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
               ]
            }
         }
      },
      {
         "Sid": "IPAllow",
         "Effect": "Allow",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:*",
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "IpAddress": {
               "aws:SourceIp": "192.168.143.0/24"
            },
            "NotIpAddress": {
               "aws:SourceIp": "192.168.143.188/32"
            }
         }
      }
   ]
}

结合静态网站的两个 s3 策略

Combining two s3 polices for static web site

policy

amazon-s3

amazon-web-services