如何创建/修改AWS IAM策略实现S3桶差异化权限管控

要实现该需求，IAM策略需遵循先允许全权限，再拒绝特定桶写入操作的逻辑（IAM中Deny优先级高于Allow），同时可明确添加该桶的只读权限（增强策略可读性）。完整策略如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "FullAccessToAllResources",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        },
        {
            "Sid": "DenyWriteActionsOnReadOnlyBucket",
            "Effect": "Deny",
            "Action": [
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:PutObjectAcl",
                "s3:DeleteObjectAcl",
                "s3:PutBucketPolicy",
                "s3:DeleteBucketPolicy",
                "s3:PutBucketAcl",
                "s3:DeleteBucket",
                "s3:PutBucketVersioning",
                "s3:PutBucketEncryption"
            ],
            "Resource": [
                "arn:aws:s3:::read-only-bucket",
                "arn:aws:s3:::read-only-bucket/*"
            ]
        },
        {
            "Sid": "ExplicitAllowReadOnlyActions",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:GetBucketAcl"
            ],
            "Resource": [
                "arn:aws:s3:::read-only-bucket",
                "arn:aws:s3:::read-only-bucket/*"
            ]
        }
    ]
}

策略说明： #

• 第一个语句授予所有AWS资源和服务的完全访问权限。
• 第二个语句拒绝read-only-bucket桶及其对象的所有写入类操作，覆盖全权限允许规则。
• 第三个语句明确允许该桶的只读操作，避免潜在规则冲突。

你的现有策略已满足需求：第一个语句授予全资源全权限，第二个语句仅拒绝my-read-only-bucket的写入操作，其他S3桶的写入权限不受影响。若需优化权限精度，可调整为以下版本：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "FullAccessToAllExceptReadOnlyBucket",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "NotResource": [
                "arn:aws:s3:::my-read-only-bucket",
                "arn:aws:s3:::my-read-only-bucket/*"
            ]
        },
        {
            "Sid": "AllowReadOnlyAccessToSpecificBucket",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:GetBucketAcl"
            ],
            "Resource": [
                "arn:aws:s3:::my-read-only-bucket",
                "arn:aws:s3:::my-read-only-bucket/*"
            ]
        }
    ]
}

修改说明： #

1. 替换原全权限允许语句，用NotResource直接排除my-read-only-bucket，让其他所有资源（含其他S3桶）获得全访问权限，无需额外Deny规则。
2. 保留并扩展只读权限语句，明确列出该桶的所有只读类操作，确保权限精准。

若需兼容原有策略逻辑，直接保留现有策略即可，它本身已实现目标——仅限制my-read-only-bucket的写入，其他S3桶不受约束。

内容的提问来源于stack exchange，提问作者Samax