如何合並 AWS S3 存儲桶策略？

Question

我們在生產中有一個現有的 S3 存儲桶策略：

{
    "Version": "2012-10-17",
    "Id": "Policy[redacted]",
    "Statement": [
        {
            "Sid": "ServiceA access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[redacted]:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::mysite-production/*"
        },
        {
            "Sid": "ServiceA access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[redacted]:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::mysite-production"
        },
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mysite-production/*"
        }
    ]
}

我們要授予訪問權限的另一個 3rd 方服務需要：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:DeleteObject"
             ],
             "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

我嘗試將ListAllMyBuckets和GetBucketLocation合並到我們原始策略的最后一部分，但會產生“策略無效操作”錯誤：

    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "*"
        },
        "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:DeleteObject"
         ],
         "Resource": "arn:aws:s3:::mysite-production/*"
    }

我怎樣才能將這些合並成一個有凝聚力的政策？ 或者一個桶是否有可能有兩個策略？

提前致謝！

Answer 1

您實際上可以同時應用 IAM 策略和 S3 存儲桶策略，最終授權是所有權限的最低權限聯合。

資料來源： https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/