Apache Camel对接Amazon S3 Bucket所需的最小权限是什么？

我开发了一个基于Apache Camel + Amazon S3的应用，负责接收端点文件、处理后上传至S3存储桶。相关配置及路由代码如下：

配置文件（application.properties） #

s3.bucket=my-bucket
camel.component.aws2-s3.access-key=${AWS_ACCESS_KEY_ID}
camel.component.aws2-s3.secret-key=${AWS_SECRET_ACCESS_KEY}
camel.component.aws2-s3.region=${AWS_REGION:us-east-2}

Camel路由代码 #

from("direct:s3")
        .log(INFO, log, "Sending to S3")
        .process(S3Processor())
        .to("aws2-s3://${properties.s3Bucket}?multiPartUpload=true&partSize=10485760")

当给IAM用户配置S3:*全权限时应用运行正常，但尝试使用以下最小权限策略时，启动应用会抛出S3相关错误：

错误的权限策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::*/*"
        }
    ]
}

启动错误栈 #

org.apache.camel.FailedToStartRouteException: Failed to start route route3 because of null
    at org.apache.camel.impl.engine.RouteService.warmUp(RouteService.java:123) ~[camel-base-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.impl.engine.InternalRouteStartupManager.doWarmUpRoutes(InternalRouteStartupManager.java:306) ~[camel-base-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.impl.engine.InternalRouteStartupManager.safelyStartRouteServices(InternalRouteStartupManager.java:189) ~[camel-base-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.impl.engine.InternalRouteStartupManager.doStartOrResumeRoutes(InternalRouteStartupManager.java:147) ~[camel-base-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.impl.engine.AbstractCamelContext.doStartCamel(AbstractCamelContext.java:3166) ~[camel-base-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.impl.engine.AbstractCamelContext.doStartContext(AbstractCamelContext.java:2846) ~[camel-base-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.impl.engine.AbstractCamelContext.doStart(AbstractCamelContext.java:2797) ~[camel-base-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.spring.boot.SpringBootCamelContext.doStart(SpringBootCamelContext.java:43) ~[camel-spring-boot-3.11.0.jar:3.11.0]
    at org.apache.camel.support.service.BaseService.start(BaseService.java:119) ~[camel-api-3.11.0.jar:3.11.0]
    at org.apache.camel.impl.engine.AbstractCamelContext.start(AbstractCamelContext.java:2494) ~[camel-base-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.impl.DefaultCamelContext.start(DefaultCamelContext.java:245) ~[camel-core-engine-3.11.0.jar:3.11.0]
    at org.apache.camel.spring.SpringCamelContext.start(SpringCamelContext.java:119) ~[camel-spring-3.11.0.jar:3.11.0]
    at org.apache.camel.spring.SpringCamelContext.onApplicationEvent(SpringCamelContext.java:151) ~[camel-spring-3.11.0.jar:3.11.0]
    at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:176) ~[spring-context-5.3.6.jar:5.3.6]
    at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:169) ~[spring-context-5.3.6.jar:5.3.6]
    at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:143) ~[spring-context-5.3.6.jar:5.3.6]
    at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:421) ~[spring-context-5.3.6.jar:5.3.6]
    at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:378) ~[spring-context-5.3.6.jar:5.3.6]
    at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:938) ~[spring-context-5.3.6.jar:5.3.6]
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:586) ~[spring-context-5.3.6.jar:5.3.6]
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:782) ~[spring-boot-2.4.5.jar:2.4.5]
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:774) ~[spring-boot-2.4.5.jar:2.4.5]
    at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:439) ~[spring-boot-2.4.5.jar:2.4.5]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:339) ~[spring-boot-2.4.5.jar:2.4.5]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1340) ~[spring-boot-2.4.5.jar:2.4.5]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1329) ~[spring-boot-2.4.5.jar:2.4.5]
    at net.myapp.RouterApplicationKt.main(RouterApplication.kt:15) ~[main/:na]

补充：仅配置s3:PutObject权限时，能通过AWS CLI正常上传文件到存储桶，但Camel应用无法启动。

问题原因及解决方案 #

核心问题

1. 资源配置错误：s3:ListBucket是桶级操作，对应的资源应该是桶的ARN（arn:aws:s3:::my-bucket），而不是对象路径（arn:aws:s3:::my-bucket/*）。你的策略里把所有权限都绑定到对象路径，导致ListBucket权限无效，Camel启动时检查桶存在性失败。
2. 分段上传额外权限：路由启用了multiPartUpload=true，Camel在处理分段上传时需要额外的权限来管理上传生命周期（比如清理失败的分段）。

正确的最小权限策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-bucket"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}

权限说明

• s3:PutObject + s3:PutObjectAcl：用于上传对象及设置对象ACL（如果不需要ACL可以移除s3:PutObjectAcl）。
• s3:ListBucket：Camel启动时会验证桶是否存在，必须绑定到桶ARN。
• 分段上传相关权限：s3:AbortMultipartUpload（取消失败的上传）、s3:ListMultipartUploadParts（列出已上传分段）、s3:ListBucketMultipartUploads（列出桶内的分段上传任务），这些是启用分段上传时必需的。

简化场景（无分段上传）

如果不需要分段上传，去掉路由中的multiPartUpload=true参数，此时最小权限可以简化为：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-bucket"
        }
    ]
}

内容的提问来源于stack exchange，提问作者ademarizu