aws s3api put-bucket-website - PutBucketWebsite 操作：訪問被拒絕

Question

我正在嘗試使用此命令來設置靜態網站托管：

aws s3api put-bucket-website --bucket XXXX --website-configuration file://assets/website.json

網站.json

{
    "IndexDocument": {
        "Suffix": "index.html"
    },
    "ErrorDocument": {
        "Key": "index.html"
    }
}

存儲桶策略

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::XXXX/*"
        }
    ]
}

我收到錯誤：

調用 PutBucketWebsite 操作時發生錯誤 (AccessDenied)：拒絕訪問

我應該在存儲桶策略中更改什么？

Answer 1

此 PUT 操作需要S3:PutBucketWebsite權限：

添加存儲桶策略：

    aws s3api put-bucket-policy \
        --bucket XXXX \
        --policy file://s3-bucket-policy.json

s3-bucket-policy.json：

{
    "Version": "2008-10-17",
    "Statement": [
         {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::XXXX/*"
         },
         {
            "Effect": "Allow",
            "Principal": {
               "AWS": "*"
            },
            "Action": [
               "S3:PutBucketWebsite"
            ],
            "Resource": "arn:aws:s3:::XXXX"
         }
    ]
}

設置靜態網站托管

aws s3api put-bucket-website \
    --bucket XXXX \
    --website-configuration file://website.json

網站.json

{
    "IndexDocument": {
        "Suffix": "index.html"
    },
    "ErrorDocument": {
        "Key": "index.html"
    }
}

Answer 2

您的存儲桶策略只允許您執行 GET 操作，但您想要執行 PUT 操作。

正如您所提到的，您的 IAM 似乎具有 Admin 和完全 S3 訪問權限，但您沒有該特定存儲桶的存儲桶級別訪問權限。

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject
            ],
            "Resource": "arn:aws:s3:::XXXX/*"
        },
        {
             "Sid": "AllowPutBucket",
             "Effect": "Allow",
             "Action": [
                 "s3:*"
             ],
              "Resource": [
                 "arn:aws:s3:::bucketname",
                  "arn:aws:s3:::bucketname/*"
              ]
        }
    ]
}