AWS S3 Bucket策略--对特定 "文件夹 "的只读访问。

Question

我正试图限制一个IAM用户对S3桶内的 "文件夹 "的访问。我以为我的配置是正确的，但读取访问似乎并不成功。

{
        "Sid": "TEST_PublicReadGetObject",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::807676775814:user/project/api/testuserapi-abc123"
        },
          "Action": [
            "s3:GetObject",
            "s3:ListBucket",
            "s3:ListBucketByTags",
            "s3:ListBucketMultipartUploads",
            "s3:ListBucketVersions",
            "s3:ListMultipartUploadParts"
        ],
        "Resource":
            "arn:aws:s3:::testbucket-securitytest/timeline/*"
    }

我是否遗漏了什么？在进行这些更改时，有时会有延迟，还是应该是即时的？

Answer 1

我想我明白了，我必须先允许ListBucket访问，然后添加Action，只允许 "文件夹 "的GetObject访问。)

{
        "Sid": "TEST_ListItems",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::807676775814:user/project/api/testuserapi"
        },
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::testbucket"
    },
    {
        "Sid": "TEST_PublicReadGetObject",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::807676775814:user/project/api/testuserapi
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::testbucket/Timeline/*"
    }`