使用Terraform部署S3策略时出现403 AccessDenied错误

数据老陈

2026-7-12

解决Terraform配置S3存储桶策略时的AccessDenied错误

在使用Terraform的aws_s3_bucket_policy资源配置S3静态网站公开访问策略时，部署出现报错：Error: putting S3 policy: AccessDenied: Access Denied，可通过以下几种方式排查解决：

检查AWS凭证权限
确保执行Terraform的AWS账号拥有s3:PutBucketPolicy权限，需在IAM策略中添加对应权限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutBucketPolicy",
      "Resource": "arn:aws:s3:::你的存储桶名称"
    }
  ]
}

关闭存储桶公共访问限制
若S3存储桶开启了「阻止公共访问」相关设置，会直接导致策略配置失败。可通过Terraform资源关闭这些限制：

resource "aws_s3_bucket_public_access_block" "bucket" {
  bucket = aws_s3_bucket.bucket.id

  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}

简化策略的资源范围
原配置中Resource包含了存储桶本身的ARN，但s3:GetObject仅需对象路径权限，可简化策略避免不必要的范围：

resource "aws_s3_bucket_policy" "bucket" {
  bucket = aws_s3_bucket.bucket.id

  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Sid       = "PublicReadGetObject"
        Effect    = "Allow"
        Principal = "*"
        Action    = "s3:GetObject"
        Resource  = "${aws_s3_bucket.bucket.arn}/*"
      },
    ]
  })
}