如何修改AWS IAM策略以限制仅访问单个CodeArtifact Python包

想要创建IAM策略，实现仅对AWS CodeArtifact上的单个Python包（myPackage1）拥有只读权限，但当前编写的策略会授予仓库内所有包的访问权限。当前策略代码如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:GetServiceBearerToken"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:GetAuthorizationToken"
            ],
            "Resource": [
                "arn:aws:codeartifact:eu-central-1:REDACTED:domain/REDACTED_DOMAIN"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:ReadFromRepository"
            ],
            "Resource": [
                "arn:aws:codeartifact:eu-central-1:REDACTED:repository/REDACTED_DOMAIN/REDACTED_REPO"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:DescribePackage",
                "codeartifact:GetPackageVersionReadme",
                "codeartifact:GetPackageVersionAsset"
            ],
            "Resource": [
                "arn:aws:codeartifact:eu-central-1:REDACTED:package/REDACTED_DOMAIN/REDACTED_REPO/pypi/*/myPackage1"
            ]
        }
    ]
}

需要修改的内容： #

1. 移除过宽的仓库级权限
   删除codeartifact:ReadFromRepository动作，它会允许访问仓库内所有包的内容，是导致权限范围过大的核心原因。

2. 修正包资源的ARN格式
   CodeArtifact的包ARN正确结构为arn:aws:codeartifact:region:account-id:package/domain/repository/package-format/package-name/*，你之前的pypi/*/myPackage1顺序错误，应调整为pypi/myPackage1/*，这样才能精准匹配目标包的所有版本。

3. 补充必要的细粒度只读动作
   添加codeartifact:ListPackageVersions、codeartifact:GetPackageVersion动作，确保能正常查询包的版本信息，完成Python包的拉取流程。

修改后的完整策略： #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:GetServiceBearerToken"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:GetAuthorizationToken"
            ],
            "Resource": [
                "arn:aws:codeartifact:eu-central-1:REDACTED:domain/REDACTED_DOMAIN"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:DescribePackage",
                "codeartifact:GetPackageVersionReadme",
                "codeartifact:GetPackageVersionAsset",
                "codeartifact:ListPackageVersions",
                "codeartifact:GetPackageVersion"
            ],
            "Resource": [
                "arn:aws:codeartifact:eu-central-1:REDACTED:package/REDACTED_DOMAIN/REDACTED_REPO/pypi/myPackage1/*"
            ]
        }
    ]
}

内容的提问来源于stack exchange，提问作者lgpasquale