Getting error: "Has prohibited field Principal", when creating policy

Question

我想创建一个允许所有人读取我的 S3 存储桶的策略，这是我创建的策略（我正在关注 this guide）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::my-s3-bucket/*",
            "Principal": "*"
        }
    ]
}

我无法创建此策略，这是我收到的错误：

This policy contains the following error: Has prohibited field Principal For more information about the IAM policy grammar, see AWS IAM Policies

Answer 1

我已经使用 Policy Generator.

生成了您想要的策略

{
  "Id": "Policy1567210887639",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1567210883302",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::my-s3-bucket/*",
      "Principal": "*"
    }
  ]
}

检查这是否适合您。

Answer 2

问题是，我在 IAM 中创建了新策略。我必须在 S3 中添加策略，作为存储桶策略：

Select S3 存储桶 -> 权限 -> 存储桶策略：在此处粘贴策略

注意：如果你想在bucket级别给匿名用户读权限，那么你需要关闭下面两个设置。