从AWS Amplify同步文件到S3遭访问拒绝，求权限配置建议

问题描述 #

我正尝试将文件从AWS Amplify同步至S3，但遇到了访问拒绝错误。以下是我的S3策略：

{"Version": "2012-10-17",
"Id": "Policy1546414473940",
"Statement": [
    {
        "Sid": "AwsAmplifyAccess",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:amplify:eu-west-3:0000000000:apps/0000000000"
        },
        "Action":  [
            "s3:ListBucket",
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:DeleteObject"
            ],
        "Resource": "arn:aws:s3:::MY_BUCKET"
    },
    {
        "Sid": "PublicReadGetObject",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::MY_BUCKET/*"
    }
]
}

解决建议 #

• 修正资源范围匹配：S3操作对资源范围有明确要求，s3:ListBucket仅作用于桶本身（arn:aws:s3:::MY_BUCKET），但PutObject、GetObject等对象级操作需要绑定桶内路径（arn:aws:s3:::MY_BUCKET/*）。当前策略把所有操作绑定到桶资源，导致对象操作权限不生效，需拆分Statement：

  {
      "Sid": "AwsAmplifyAccess",
      "Effect": "Allow",
      "Principal": {
          "AWS": "arn:aws:amplify:eu-west-3:0000000000:apps/0000000000"
      },
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::MY_BUCKET"
  },
  {
      "Sid": "AwsAmplifyObjectAccess",
      "Effect": "Allow",
      "Principal": {
          "AWS": "arn:aws:amplify:eu-west-3:0000000000:apps/0000000000"
      },
      "Action": [
          "s3:PutObject",
          "s3:PutObjectAcl",
          "s3:GetObject",
          "s3:GetObjectAcl",
          "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::MY_BUCKET/*"
  }
  

• 验证Principal的准确性：核对Amplify应用ARN的账号ID、应用ID是否与实际一致，确保授权对象正确。
• 检查桶的公共访问阻塞设置：确认S3桶的"阻止公共访问"选项未干扰Amplify的同步权限（尤其是如果策略涉及对象操作时）。
• 查看CloudTrail日志：通过CloudTrail事件日志定位具体被拒绝的操作、请求来源，精准排查权限缺失点。

内容的提问来源于stack exchange，提问作者emilie zawadzki