amazon-web-services - 在无服务器中创建 S3 存储桶策略 - 发生错误 : BucketPolicy - Invalid policy syntax

Question

我正在尝试在 serverless.yml 文件中添加 S3 存储桶策略，该策略将授予我创建的 IAM 用户对该存储桶的权限。

我首先直接在控制台中直接在不同阶段(开发)的存储桶上添加策略，现在我尝试在不同阶段(测试)的无服务器中复制该策略。

但是，即使我遵循 aws documentation我似乎不太明白。以下是我的 serverless.yml 文件中的策略。为了减少出现错误的可能性，我直接复制我的主体和资源。

    S3CredentialsBucket:
      Type: 'AWS::S3::Bucket'
    BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties:
        Bucket: !Ref S3CredentialsBucket
        PolicyDocument:
          Id: ProdAnsiblePolicy
          Version: "2012-10-17"
          Statement:
            -
              Effect: Allow
              Principal: 'arn:aws:iam::***********:user/prodAnsible'
              Action: 's3:*'
              Resource: 'arn:aws:s3:::test-mr-2-current-tenant-configurations'

下面是我直接在控制台中添加到存储桶中的策略，该策略有效 - 这意味着用户可以将对象放入存储桶中。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::***********:user/prodAnsible"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::dev-2-current-tenant-configurations"
        },
        {
            "Sid": "statement2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::***********:user/prodAnsible"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::dev-2-current-tenant-configurations/*"
        }
    ]
}

事实上，我在尝试部署时收到以下错误:“发生错误:BucketPolicy - 无效的策略语法。”。任何帮助将不胜感激!

最后看一下无服务器文件 cloudformation-template-update-stack.json。

    "S3TenantConfigBucket": {
      "Type": "AWS::S3::Bucket"
    },
    "BucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "S3TenantConfigBucket"
        },
        "PolicyDocument": {
          "Id": "ProdAnsiblePolicy",
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::249161078948:user/prodAnsible"
              },
              "Action": "s3:*",
              "Resource": "arn:aws:s3:::test-mr-2-current-tenant-configurations/*"
            }
          ]
        }
      }
    }
  }

还值得注意的是，这是创建存储桶的方式:

    events:
      - s3:
          bucket: ${self:custom.s3_bucket}
          event: s3:ObjectCreated:*

这是一种事件驱动方法，符合 serverless docs 预先感谢!

Answer 1

如果您指定的主体是 IAM 用户，您需要将其添加为 AWS 键的值。引用:AWS JSON Policy Elements: Principal

    S3CredentialsBucket:
      Type: 'AWS::S3::Bucket'
    BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties:
        Bucket: !Ref S3CredentialsBucket
        PolicyDocument:
          Id: ProdAnsiblePolicy
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                AWS: 'arn:aws:iam::***********:user/prodAnsible'
              Action: 's3:*'
              Resource: 'arn:aws:s3:::test-mr-2-current-tenant-configurations'