如何在AWS SAM模板中授予S3存储桶的公开只读访问权限

huangapple
go评论117阅读模式
英文:

How to grant public read only access to S3 Bucket in AWS SAM template

问题

  1. 我正在创建一个SAM模板中的S3存储桶，并希望为其提供公共读取权限。到目前为止，我想到了以下内容：
  3.   ProductBucket:
  4.     Type: AWS::S3::Bucket
  5.     Properties:
  6.       BucketName: !Sub ${ProductBucketName}${Stage}
  9.   ProductBucketPolicy:
  10.     Type: AWS::S3::BucketPolicy
  11.     Properties:
  12.       Bucket: !Ref ProductBucket
  13.       PolicyDocument:
  14.         Id: PublicReadPolicy
  15.         Version: 2012-10-17
  16.         Statement:
  17.           - Sid: PublicReadForGetBucketObjects
  18.             Effect: Allow
  19.             Principal: '*'
  20.             Action: 's3:GetObject'
  21.             Resource: !Join
  22.               - ''
  23.               - - 'arn:aws:s3:::'
  24.                 - !Ref ProductBucket
  26. 这导致了一个格式不正确的异常。
英文:

I am creating an S3 bucket in a SAM template and would like to give it public read access. This is what I came up with so far:

  1.   ProductBucket:
  2.     Type: AWS::S3::Bucket
  3.     Properties:
  4.       BucketName: !Sub ${ProductBucketName}${Stage}
  7.   ProductBucketPolicy:
  8.     Type: AWS::S3::BucketPolicy
  9.     Properties:
  10.       Bucket: !Ref ProductBucket
  11.       PolicyDocument:
  12.         Id: PublicReadPolicy
  13.         Version: 2012-10-17
  14.         Statement:
  15.           - Sid: PublicReadForGetBucketObjects
  16.             Effect: Allow
  17.             Principal: '*'
  18.             Action: 's3:GetObject'
  19.             Resource: !Join
  20.               - ''
  21.               - - 'arn:aws:s3:::'
  22.                 - !Ref ProductBucket

This fails with a malformed exception.

答案1

得分: 3

Your template is fine except the line that says - - 'arn:aws:s3:::' where its malformed. Just a suggestion that you can use Fn::Sub over Fn::Join when delimiter is an empty string.

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
ProductBucketName:
Type: String

Resources:
ProductBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Sub ${ProductBucketName}-${AWS::StackName}

ProductBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref ProductBucket
PolicyDocument:
Id: PublicReadPolicy
Version: 2012-10-17
Statement:
- Sid: PublicReadForGetBucketObjects
Effect: Allow
Principal: ''
Action: 's3:GetObject'
Resource: !Sub arn:aws:s3:::${ProductBucket}/

Hope this helps you move forward.

英文:

Your template is fine except the line that says - - 'arn:aws:s3:::' where its malformed. Just a suggestion that you can use Fn::Sub over Fn::Join when delimiter is an empty string.

  1. AWSTemplateFormatVersion: "2010-09-09"
  3. Parameters:
  4.   ProductBucketName:
  5.     Type: String
  7. Resources:
  8.   ProductBucket:
  9.     Type: AWS::S3::Bucket
  10.     Properties:
  11.       BucketName: !Sub ${ProductBucketName}-${AWS::StackName}
  14.   ProductBucketPolicy:
  15.     Type: AWS::S3::BucketPolicy
  16.     Properties:
  17.       Bucket: !Ref ProductBucket
  18.       PolicyDocument:
  19.         Id: PublicReadPolicy
  20.         Version: 2012-10-17
  21.         Statement:
  22.           - Sid: PublicReadForGetBucketObjects
  23.             Effect: Allow
  24.             Principal: '*'
  25.             Action: 's3:GetObject'
  26.             Resource: !Sub arn:aws:s3:::${ProductBucket}/*

Hope this help you move forward.

答案2

得分: 1

我发现AWS文档的YAML示例看起来有点奇怪，但我按照它的示例为我的CF堆栈授予了IAM s3:PutBucketPolicy权限，它运行正常。以下是我的SAM。

  1.   ExampleBucket:
  2.     Type: AWS::S3::Bucket
  3.     Properties:
  4.       BucketName: !Sub <bucket-name>
  6.   ExampleBucketPolicy:
  7.     Type: AWS::S3::BucketPolicy
  8.     Properties:
  9.       Bucket:
  10.         Ref: "ExampleBucket"
  11.       PolicyDocument:
  12.         Statement:
  13.           - Action:
  14.               - "s3:GetObject"
  15.             Effect: "Allow"
  16.             Resource:
  17.               Fn::Join:
  18.                 - ""
  19.                 - - "arn:aws:s3:::"
  20.                   - Ref: "ExampleBucket"
  21.                   - "/*"
  22.             Principal: "*"

这是您可能已经查阅的AWS文档页面链接：https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html.

英文:

I found the AWS documentation's yaml example to look a bit funny, but I followed it and gave my CF stack IAM s3:PutBucketPolicy permissions, and it worked. Below is my SAM.

  1.   ExampleBucket:
  2.     Type: AWS::S3::Bucket
  3.     Properties:
  4.       BucketName: !Sub &lt;bucket-name&gt;
  6.   ExampleBucketPolicy:
  7.     Type: AWS::S3::BucketPolicy
  8.     Properties:
  9.       Bucket:
  10.         Ref: &quot;ExampleBucket&quot;
  11.       PolicyDocument:
  12.         Statement:
  13.           - Action:
  14.               - &quot;s3:GetObject&quot;
  15.             Effect: &quot;Allow&quot;
  16.             Resource:
  17.               Fn::Join:
  18.                 - &quot;&quot;
  19.                 - - &quot;arn:aws:s3:::&quot;
  20.                   - Ref: &quot;ExampleBucket&quot;
  21.                   - &quot;/*&quot;
  22.             Principal: &quot;*&quot;

Here is the AWS documentation page you've probably already consulted: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html.

huangapple
  • 本文由 发表于 2020年1月3日 23:18:22
  • 转载请务必保留本文链接：https://go.coder-hub.com/59581050.html
  • amazon-s3
  • aws-sam
  • yaml
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定