使用Serverless Framework发布静态网站遇S3权限及变量解析错误求助

针对你遇到的两个问题，以下是修正后的配置写法：

方案1：利用Serverless Lift内置配置（推荐） #

直接在static-website构造中配置公开访问控制和安全策略，无需手动添加BucketPolicy，避免变量错误和权限问题：

provider:
  name: aws

constructs:
  landing:
    type: static-website
    path: dist
    # 配置S3公开访问控制，适配AWS新策略
    publicAccessBlock:
      blockPublicAcls: false
      blockPublicPolicy: false
      ignorePublicAcls: false
      restrictPublicBuckets: false
    # 配置安全的公开访问策略（强制HTTPS）
    policy:
      statements:
        - Effect: Allow
          Action: s3:GetObject
          Principal: "*"
          Resource: "arn:aws:s3:::${construct:landing.bucketName}/*"
          Condition:
            Bool:
              aws:SecureTransport: true

plugins:
  - serverless-lift
  - serverless-offline

package:
  patterns:
    - '!node_modules/**'

方案2：自定义BucketPolicy（需注意变量和资源结构） #

如果必须手动配置BucketPolicy，要注意以下两点：

• Lift的static-website构造暴露的Bucket名称变量是${construct:landing.bucketName}，而非assetsBucketName
• PublicAccessBlockConfiguration属于S3 Bucket资源的属性，不能放在BucketPolicy里

修正后的自定义配置：

provider:
  name: aws

constructs:
  landing:
    type: static-website
    path: dist
    # 先在构造中禁用默认的BucketPolicy，避免冲突
    policy: false

plugins:
  - serverless-lift
  - serverless-offline

package:
  patterns:
    - '!node_modules/**'

resources:
  Resources:
    # 覆盖Lift创建的Bucket，添加公开访问控制
    LandingBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${construct:landing.bucketName}
        PublicAccessBlockConfiguration:
          BlockPublicAcls: false
          BlockPublicPolicy: false
          IgnorePublicAcls: false
          RestrictPublicBuckets: false
    # 自定义BucketPolicy
    LandingBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: ${construct:landing.bucketName}
        PolicyDocument:
          Version: "2012-10-17"
          Statement: 
            - Sid: AllowPublicReadAccess
              Effect: Allow
              Action: 
                - "s3:GetObject"
              Resource: 
                - "arn:aws:s3:::${construct:landing.bucketName}/*"
              Principal: "*"    
              Condition:
                Bool:
                  aws:SecureTransport: 'true'

关键修正点说明 #

• 错误1根源：AWS默认启用了S3公开访问阻止策略，Lift默认配置无法绕过，需显式在构造中设置publicAccessBlock
• 错误2根源：使用了错误的变量名，Lift的static-website构造对外暴露的Bucket名称变量是bucketName，不是assetsBucketName；同时PublicAccessBlockConfiguration是Bucket资源的属性，不属于BucketPolicy

内容的提问来源于stack exchange，提问作者AntN