[英]Allow CloudFront to access S3 origin while also having S3 bucket Block all public access?
[英]Allow CloudFront to access an S3 bucket with an origin access identity
我已經做了一個靜態網站,托管由CloudFront服務的S3存儲桶。 我想僅通過原始訪問身份限制從CloudFront直接進行存儲桶訪問。
我嘗試更新S3存儲桶策略,但顯示錯誤:
Error putting S3 policy: MalformedPolicy: Invalid principal in policy status code: 400, request id
我正在嘗試使用以下政策:
resource "aws_s3_bucket_policy" "default" {
bucket = "${aws_s3_bucket.default.id}"
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "2",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${aws_cloudfront_origin_access_identity.origin_access_identity.id}"
},
"Action": "s3:*",
"Resource": "arn:aws:s3:::$/*"
}
]
}
EOF
}
如aws_cloudfront_origin_access_identity文檔中所述,最好的方法是通過使用aws_iam_policy_document
數據源生成IAM策略文檔,然后將其直接附加。
一個例子看起來像這樣:
data "aws_iam_policy_document" "s3_policy" {
statement {
actions = ["s3:GetObject"]
resources = ["${module.names.s3_endpoint_arn_base}/*"]
principals {
type = "AWS"
identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
}
}
statement {
actions = ["s3:ListBucket"]
resources = ["${module.names.s3_endpoint_arn_base}"]
principals {
type = "AWS"
identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
}
}
}
resource "aws_s3_bucket" "bucket" {
# ...
policy = "${data.aws_iam_policy_document.s3_policy.json}"
}
如果您真的想像問題中那樣手工制定IAM策略,那么您只需要以下內容:
resource "aws_s3_bucket_policy" "default" {
bucket = "${aws_s3_bucket.default.id}"
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "2",
"Effect": "Allow",
"Principal": {
"AWS": "${aws_cloudfront_origin_access_identity.origin_access_identity.id}"
},
"Action": "s3:*",
"Resource": "${aws_s3_bucket.default.arn}""
}
]
}
EOF
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.