S3存储桶策略-使用“任何经过身份验证的用户”还是存储桶策略？

Question

I've set up an S3 bucket and an IAM user who has full access to the bucket.

Im confused about how to restrict access to the bucket so only this user and cloud front can access it. The cloud front policy was auto generated for me in the cloudfront control pannel.

But as for allowing only my IAM user access, do I:

• Allow "Any Authenticated User", does this refer to my IAM user or to any AWS user in general?

• Or do I need to amend the bucket policy?

Answer 1

Any Authenticated User means any user that has an Amazon AWS Account.

You may want to attach a policy to the IAM user and not deal with bucket policy. Or add a bucket policy to allow only that IAM user. Examples for both are in: IAM Policies and Bucket Policies

Sample S3 Bucket Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::111122223333:user/Alice",
                "arn:aws:iam::111122223333:root"]
      },
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::my_bucket",
                   "arn:aws:s3:::my_bucket/*"]
    }
  ]
}

Sample IAM Policy

{
  "Version": "2012-10-17",
  "Statement":[{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::my_bucket",
                 "arn:aws:s3:::my_bucket/*"]
    }
  ]
}