Terraform s3_bucket_policy

Question

我正在使用 Terraform 构建 AWS 环境，但 s3 存储桶策略和帐户存在问题。

resource "aws_s3_bucket_policy" "awsbucketprodpolicy" {
    bucket = local.prodtbucket
    policy = jsonencode({
        Version = "2012-10-17"
        #Id = format("%s-policy", local.vaultbucket )
        Statement = [
            {
                #Sid = "prodpolicy"
                Effect = "Allow"
                Principal = "*" #aws_organizations_account.prodbucket.arn #"*"
                Action = "s3:CopyObject
        #["s3:CopyObject","s3:DeleteObject","s3:GetObject"]
                Resource = [
                    aws_s3_bucket.prodbucket.arn,
                    "${aws_s3_bucket.prodbucket.arn}/*",
                ]
            }
        ],
    })
}

我收到操作错误。 放置 S3 策略时出错：MalformedPolicy：策略具有无效操作。 它适用于“s3:8)”但不适用于确切的操作。

Answer 1

您的策略密钥当前包含已注释掉的语句，这些语句未正确编码为 JSON。 Action行也缺少引号。
最后，copyObject 命令没有策略操作， 根据这篇文章，您至少需要 listObject 和 getObject 权限才能执行此操作

清理策略 object：

{
        Version = "2012-10-17"
        Statement = [
            {
                Effect = "Allow"
                Principal = "*"
                Action = [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject",
                ]
                Resource = [
                    "${aws_s3_bucket.prodbucket.arn}/*"                    ]
            }
        ],
    }