AWS S3存储桶策略-仅在前缀内允许GetObject

Question

I'm trying to put a policy on my bucket to allow public 'GetObject' access on my objects, but only those within a certain prefix. Like this:

    {
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::mybucket/publicstuff/*"
    }

The problem is, AWS warns me that this makes the entire bucket public. And sure enough, it does; if I try to GET an object from /mybucket/anywhereelse/, S3 serves it up freely. So everything after 'mybucket' is ignored.

Is there any way to build a bucket policy applicable to a specific prefix within the bucket? I tried a policy condition, but found the s3:prefix cannot be used when using the s3:GetObject action.

Answer 1

That is totally fine, although you see an indication, showing that your bucket is publicly accessible. You should notice that this indicator shows that the public access to (some contents of) this bucket is provided.
So to check that there is no problem you can just test a file outside the publicly accessible folder and compare that with a file which should be publicly accessible due to your policy.
You can see in the following picture that I have made a sub-folder of my bucket (toignore), accessible to the public:

This is the tree-view of the bucket:

├── directory
│ ├── toignore
│ │ └── i.txt
└── ni.txt

Based on my policy, i.txt is publicly accessible but ni.txt is not, and the indicator shows the public access.

Answer 2

Thanks @michael and @mok, I've found the answer: I'm a moron. The other objects that I used to verify the standard behavior happen to have individual permissions on them to allow getObject, and I didn't remember putting them there or notice them being there. When I removed these permissions, It appeared I could still access these objects, but I was actually picking up cached copies. When removing these spurious permissions, and using a completely different browser, I verified that my originally posted policy was correct. Sorry for the trouble.