如何在 AWS SAM 模板中授予 public 对 S3 存储桶的只读访问权限

Question

我正在 SAM 模板中创建 S3 存储桶，并想授予它 public 读取权限。这是我到目前为止想出的：

  ProductBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ProductBucketName}${Stage}


  ProductBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ProductBucket
      PolicyDocument:
        Id: PublicReadPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref ProductBucket

此操作失败并出现格式错误的异常。

Answer 1

我发现 AWS 文档的 yaml 示例看起来有点滑稽，但我按照它进行操作并授予我的 CF 堆栈 IAM s3:PutBucketPolicy 权限，并且它起作用了。下面是我的山姆。

  ExampleBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub <bucket-name>

  ExampleBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: "ExampleBucket"
      PolicyDocument:
        Statement:
          - Action:
              - "s3:GetObject"
            Effect: "Allow"
            Resource:
              Fn::Join:
                - ""
                - - "arn:aws:s3:::"
                  - Ref: "ExampleBucket"
                  - "/*"
            Principal: "*"

这是您可能已经查阅过的 AWS 文档页面：https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html.

Answer 2

除了格式错误的 - - 'arn:aws:s3:::' 行外，您的模板很好。只是一个建议，当分隔符为空字符串时，您可以使用 Fn::Sub 而不是 Fn::Join。

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  ProductBucketName:
    Type: String

Resources:
  ProductBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ProductBucketName}-${AWS::StackName}


  ProductBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ProductBucket
      PolicyDocument:
        Id: PublicReadPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Sub arn:aws:s3:::${ProductBucket}/*

希望这能帮助你前进。

如何在 AWS SAM 模板中授予 public 对 S3 存储桶的只读访问权限

How to grant public read only access to S3 Bucket in AWS SAM template

yaml

amazon-s3

aws-sam