AWS Cloudformation 模板 - S3 存储桶策略 - MalformedPolicy 错误

Question

我正在尝试向我的（静态网站）S3 存储桶添加策略以仅允许 CloudFormation 分发访问它，但在部署期间我仍然遇到MalformedPolicy错误并且无法找到问题所在。

CloudFormation 模板基本部分

Resources:

  BucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    DependsOn:
      - AppBucket
      - CloudFrontDistribution
    Properties:
      Bucket: !Ref AppBucket
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PolicyForCloudFrontPrivateContent
            Action: 's3:GetObject*'
            Effect: Allow
            Condition:
              StringLike:
                'aws:Referer':
                  - !Sub 'https://*.${CloudFrontDistribution}.cloudfront.net/*'
              Resource: 
                - !Sub arn:aws:s3:::${AppBucket}

  CloudFrontDistribution:
    # ...

  AppBucket:
    # ...

部署错误

(...)

CloudFormation events from stack operations (refresh every 0.5 seconds)
---------------------------------------------------------------------------------------------------------------------------------------------
ResourceStatus                      ResourceType                        LogicalResourceId                   ResourceStatusReason              
---------------------------------------------------------------------------------------------------------------------------------------------
UPDATE_IN_PROGRESS                  AWS::S3::BucketPolicy               BucketPolicy                        -                                 
UPDATE_FAILED                       AWS::S3::BucketPolicy               BucketPolicy                        Missing required field Principal  
                                                                                                            (Service: Amazon S3; Status Code: 
                                                                                                            400; Error Code: MalformedPolicy; 
                                                                                                            Request ID: DG2QHRDJQ2WS6JZV; S3  
                                                                                                            Extended Request ID: 6u+LYv77A4Ao 
                                                                                                            DmKmyB4Sfup+rueC1iGAQ82GdkfHimIZL 
                                                                                                            X/HXUPWj2FKSq7WCgi41F4XU6z6BOk=;  
                                                                                                            Proxy: null)                      
UPDATE_ROLLBACK_IN_PROGRESS         AWS::CloudFormation::Stack          test-app-hosting                    The following resource(s) failed  
                                                                                                            to update: [BucketPolicy].        
UPDATE_COMPLETE                     AWS::S3::BucketPolicy               BucketPolicy                        -                                 
UPDATE_ROLLBACK_COMPLETE_CLEANUP_   AWS::CloudFormation::Stack          test-app-hosting                    -                                 
IN_PROGRESS                                                                                                                                   
UPDATE_ROLLBACK_COMPLETE            AWS::CloudFormation::Stack          test-app-hosting                    -                                 
---------------------------------------------------------------------------------------------------------------------------------------------
Error: Failed to create/update the stack: test-app-hosting, Waiter StackUpdateComplete failed: Waiter encountered a terminal failure state: For expression "Stacks[].StackStatus" we matched expected path: "UPDATE_ROLLBACK_COMPLETE" at least once

更新 #1

正如 bot @luk2302 和 @Marcin 指出的那样，我错过了Statement > Principal部分（对此感觉很愚蠢），但添加它现在会出现一个新错误：

---------------------------------------------------------------------------------------------------------------------------------------------
ResourceStatus                      ResourceType                        LogicalResourceId                   ResourceStatusReason              
---------------------------------------------------------------------------------------------------------------------------------------------
UPDATE_IN_PROGRESS                  AWS::S3::BucketPolicy               BucketPolicy                        -                                 
UPDATE_FAILED                       AWS::S3::BucketPolicy               BucketPolicy                        Invalid policy syntax. (Service:  
                                                                                                            Amazon S3; Status Code: 400;      
                                                                                                            Error Code: MalformedPolicy;      
                                                                                                            Request ID: NH6PZB3QF0747F4N; S3  
                                                                                                            Extended Request ID: xdXOFPWgHCjg 
                                                                                                            Lzf4gdjCg79NIXS6qtmtLuGn8N7NeLIOJ 
                                                                                                            4Qw2bgSJ2v6MKdNzbrMCWCEPKBc90E=;  
                                                                                                            Proxy: null)                      
UPDATE_ROLLBACK_IN_PROGRESS         AWS::CloudFormation::Stack          test-app-hosting                    The following resource(s) failed  
                                                                                                            to update: [BucketPolicy].

Answer 1

Resource的用途不正确，并且您缺少AWS 文档中所述的Principal 。 它应该是：

  BucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    DependsOn:
      - AppBucket
      - CloudFrontDistribution
    Properties:
      Bucket: !Ref AppBucket
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PolicyForCloudFrontPrivateContent
            Action: 's3:GetObject*'
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Resource: 
              - !Sub arn:aws:s3:::${AppBucket}              
            Condition:
              StringLike:
                'aws:Referer':
                  - !Sub 'https://*.${CloudFrontDistribution}.cloudfront.net/*'

Answer 2

好的，经过大量试验和错误后，我发现主要问题在于提供Resource和Condition.StringLike.aws:Referer数组值而不是字符串：

错误的

Resource:
  - !Sub arn:aws:s3:::${AppBucket}
Condition:
  StringLike:
    'aws:Referer':
      - !Sub 'https://*.${CloudFrontDistribution}.cloudfront.net/*'

正确的

Resource: !Sub arn:aws:s3:::${AppBucket}
Condition:
  StringLike:
    'aws:Referer': !Sub 'https://*.${CloudFrontDistribution}.cloudfront.net/*'