在无服务器中创建 S3 存储桶策略 - 发生错误：BucketPolicy - 无效的策略语法

Question

我正在尝试在我的 serverless.yml 文件中添加一个 S3 存储桶策略，该策略将授予我创建的 IAM 用户对存储桶的权限。

我开始只是直接在控制台中的不同阶段 (dev) 中将策略添加到存储桶上，现在我正尝试在不同阶段 (test) 中复制无服务器中的策略。

然而，尽管我在关注 aws documentation，但我似乎不太明白。下面是我的 serverless.yml 文件中的政策。为了减少出错的可能性，我直接复制了我的主体和资源。

    S3CredentialsBucket:
      Type: 'AWS::S3::Bucket'
    BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties:
        Bucket: !Ref S3CredentialsBucket
        PolicyDocument:
          Id: ProdAnsiblePolicy
          Version: "2012-10-17"
          Statement:
            -
              Effect: Allow
              Principal: 'arn:aws:iam::***********:user/prodAnsible'
              Action: 's3:*'
              Resource: 'arn:aws:s3:::test-mr-2-current-tenant-configurations'

下面是我在控制台中直接添加到存储桶的策略，该策略有效 - 这意味着用户可以将对象放入存储桶。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::***********:user/prodAnsible"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::dev-2-current-tenant-configurations"
        },
        {
            "Sid": "statement2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::***********:user/prodAnsible"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::dev-2-current-tenant-configurations/*"
        }
    ]
}

事实上，我在尝试部署时遇到以下错误："An error occurred: BucketPolicy - Invalid policy syntax."。任何帮助将不胜感激！

最后看一下无服务器文件 cloudformation-template-update-stack.json.

    "S3TenantConfigBucket": {
      "Type": "AWS::S3::Bucket"
    },
    "BucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "S3TenantConfigBucket"
        },
        "PolicyDocument": {
          "Id": "ProdAnsiblePolicy",
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::249161078948:user/prodAnsible"
              },
              "Action": "s3:*",
              "Resource": "arn:aws:s3:::test-mr-2-current-tenant-configurations/*"
            }
          ]
        }
      }
    }
  }

另外值得注意的是存储桶的创建方式：

    events:
      - s3:
          bucket: ${self:custom.s3_bucket}
          event: s3:ObjectCreated:*

根据 serverless docs，这是一种事件驱动的方法提前致谢！

Answer 1

如果您指定的主体是 IAM 用户，则需要将其添加为 AWS 键的值。参考：AWS JSON Policy Elements: Principal

    S3CredentialsBucket:
      Type: 'AWS::S3::Bucket'
    BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties:
        Bucket: !Ref S3CredentialsBucket
        PolicyDocument:
          Id: ProdAnsiblePolicy
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                AWS: 'arn:aws:iam::***********:user/prodAnsible'
              Action: 's3:*'
              Resource: 'arn:aws:s3:::test-mr-2-current-tenant-configurations'

在无服务器中创建 S3 存储桶策略 - 发生错误：BucketPolicy - 无效的策略语法

Creating S3 bucket policy in serverless - An error occurred: BucketPolicy - Invalid policy syntax

amazon-s3

amazon-web-services

amazon-cloudformation

serverless-framework

aws-serverless