AWS S3存储桶策略访问被拒绝

Question

Trying to set bucket policy for S3 bucket but get an error Access denied:

All options in Public access setting are set to false:

So, the question is what do I need to set bucket policy?

Answer 1

S3 is secure by default, and always has been -- the user has always needed to take deliberate, purposeful steps in order to "accidentally" make their bucket content public... yet users still make configuration errors on occasion and expose their buckets.

AWS implemented two levels of anti-footgun protection, designed to make these mistakes more difficult -- there are bucket-level and acccount level settings to prevent public access to buckets, both of which need to "allow" you to do this. If either policy prevents you from making the bucket public, you'll get Access Denied when trying to create or change a bucket policy if the system categorizes your new policy as even slightly "public."

Before you proceed and turn off the safety, note that the system is trying to protect you from yourself. There is essentially never a valid reason to allow * to write to or delete from your bucket. "Principal": "*" means any user, including unauthenticated/anonymous users.

Find "Public access settings for this account" in the left-side navigation pane of the S3 console for the global settings.

https://aws.amazon.com/blogs/aws/amazon-s3-block-public-access-another-layer-of-protection-for-your-accounts-and-buckets/

Answer 2

Seems look like the user account you're trying do this, doesn't have permission to change this particular bucket. Please check your account permission on IAM or on account panel.

Answer 3

To view a bucket policy, your IAM user or role must have permission to the s3:GetBucketPolicy action. To edit an existing bucket policy, your IAM user or role must have permission to the s3:PutBucketPolicy action.

Also, make sure that there are no Deny statements in your IAM policy that override the bucket policy permissions.

By the way, I notice that your proposed S3 bucket policy allows anyone to delete objects. I'm not sure if that was your intention but it's typically not advisable to do this.