AWS S3 Bucket CORS 配置：策略阻止，尽管所有访问

Question

我正在尝试了解如何配置 AWS S3 存储桶以便我可以向其上传。我按照 this tutorial 中的说明进行操作，但仍然收到一条错误消息：

Access to fetch at 'https://s3.ap-southeast-2.amazonaws.com/' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

我有一个具有以下 CORS 策略的存储桶（在开发中）：

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "PUT",
            "POST",
            "DELETE"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": []
    }
]

我有如下的存储桶策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:List*",
                "s3:Get*"
            ],

// Note: I have also tried using the wildcard '*' to allow all actions, but i get the same error message as shown above

        "Resource": [
            "arn:aws:s3:::[MY_BUCKET_NAME]",
            "arn:aws:s3:::[MY_BUCKET_NAME]/*"
        ]
    }
]

}

我看到AWS policy 多了一个ACL 部分，里面有勾选list 和read 的选项，但是write 按钮是灰色的，并警告不要使用它来允许所有人写。我勾选了它们以允许 public 每个人都可以列出和阅读（我不知道如何编辑灰色的写入选项）。我处于开发模式，想找到一种方法来测试连接是否可以正常运行，所以想写。即使我尝试这样做，我也会收到与上面发布的相同的错误。

我正在查找有关如何连接到 AWS S3 存储桶的最新说明。似乎配置要求的变化比创建博客教程的速度更快。 SO 上的许多答案不再映射到 AWS S3 配置文件中的配置设置。

Answer 1

您收到的 CORS 错误应该仅与 CORS 配置有关，与存储桶策略无关。

我注意到您引用的错误消息不包括存储桶名称。通常对于 CORS 错误，它应该看起来像这样：

'https://<bucket>.s3.eu-west-2.amazonaws.com/' from origin 'https://localhost:3001' has been blocked by CORS policy

建议您仔细检查代码中的 BUCKET_NAME。

我也不知道你用什么方法调用API，但为了完整起见，你也可以包括HEAD方法。

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "POST",
            "GET",
            "PUT",
            "DELETE",
            "HEAD"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": []
    }
]

对我来说，这适用于从客户端上传。

AWS S3 Bucket CORS 配置：策略阻止，尽管所有访问

AWS S3 Bucket CORS configuration: policy block despite all access

amazon-s3

amazon-web-services

cors