[英]How to access S3 bucket created in us-west-2 region from us-east-1 account?
I have account A with us-east-1 region having IAM role rt-profileRole and my application setup.我在 us-east-1 区域有账户 A,具有 IAM 角色 rt-profileRole 和我的应用程序设置。 Account B created S3 bucket in us-west-1 and us-west-2.
账户 B 在 us-west-1 和 us-west-2 中创建了 S3 存储桶。
I am trying to list object using aws cli with role rtprofile.我正在尝试使用具有角色 rtprofile 的 aws cli 列出 object。 both bucket have similar bucket policy as below resource having correct bucket arn of bucket to which policy attach.
两个存储桶都具有与以下资源类似的存储桶策略,该资源具有正确的存储桶 arn 策略附加到的存储桶。
Problem is I can list object from bucket created in us-west-1 using aws s3 ls from my local system.问题是我可以使用本地系统中的 aws s3 ls 从 us-west-1 创建的存储桶中列出 object 。 But I got error when I try same for bucket created in us-west-2 An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
但是当我尝试对 us-west-2 中创建的存储桶进行相同操作时出现错误调用 ListObjectsV2 操作时发生错误 (AccessDenied):访问被拒绝
I tired with multiple bucket and concluded that using account A role我厌倦了多个存储桶并得出结论,使用帐户 A 角色
Please help me to understand what wrong with west-2 region here.请帮助我了解这里的 west-2 区域有什么问题。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DelegateS3Access",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::AccountA:role/rt-profileRole"
]
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::bucket-name/*",
"arn:aws:s3:::bucket-name"
]
}
]
}
Once you add the bucket policy to the bucket, you must also ensure the role has privileges in its IAM policy.将存储桶策略添加到存储桶后,您还必须确保该角色在其 IAM 策略中具有特权。
In addition if you're in an AWS organisation ensure there is no SCP on Account A that is prevent actions within a specific region.此外,如果您在 AWS 组织中,请确保账户 A 上没有阻止特定区域内操作的 SCP。
Regarding the bucket policy you should scope this down to the permissions you want the bucket to use once you're confirmed it works (its currently every S3 action on the bucket including deletes).关于存储桶策略,您应该将其 scope 归结为您希望存储桶在您确认它有效后使用的权限(目前它对存储桶的每个 S3 操作,包括删除)。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.