部署CloudFormation S3桶模板时持续触发InvalidBucketAclWithBlockPublicAccessError

问题根源 #

你碰到的InvalidBucketAclWithBlockPublicAccessError错误，核心是S3的Block Public Access规则和桶ACL的PublicRead设置冲突。哪怕你加了PublicAccessBlockConfiguration，要么是配置位置不对，要么是AWS默认行为限制导致没生效。另外现在AWS更推荐用桶策略而非ACL来配置公开访问，ACL的PublicRead在新桶默认设置下很容易触发这类冲突。

修复方案 #

方案1：修正模板（保留ACL + 正确配置PublicAccessBlock） #

把PublicAccessBlockConfiguration正确嵌套到Bucket的Properties里，同时保持OwnershipControls为BucketOwnerPreferred，完整模板如下：

SomeS3Bucket:
  Type: "AWS::S3::Bucket"
  Properties:
    BucketName: "some-bucket-name"
    AccessControl: PublicRead
    OwnershipControls:
      Rules:
        - ObjectOwnership: BucketOwnerPreferred
    PublicAccessBlockConfiguration:
      BlockPublicAcls: false
      BlockPublicPolicy: false
      IgnorePublicAcls: false
      RestrictPublicBuckets: false
    BucketEncryption:
      ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: "AES256"
          BucketKeyEnabled: false
    CorsConfiguration:
      CorsRules:
        - AllowedHeaders:
            - "*"
          AllowedMethods:
            - "PUT"
            - "POST"
            - "DELETE"
            - "GET"
          AllowedOrigins:
            - "*"

方案2：用桶策略替代ACL（推荐，符合AWS最佳实践） #

AWS官方现在不建议用ACL做公开访问配置，改用桶策略能彻底避免ACL和Block Public Access的冲突。修改模板步骤：

1. 删除AccessControl: PublicRead
2. 新增BucketPolicy资源来允许所有人读取桶内对象
3. 调整PublicAccessBlockConfiguration（因为不用ACL了，可以开启相关限制）

完整模板：

SomeS3Bucket:
  Type: "AWS::S3::Bucket"
  Properties:
    BucketName: "some-bucket-name"
    OwnershipControls:
      Rules:
        - ObjectOwnership: BucketOwnerPreferred
    PublicAccessBlockConfiguration:
      BlockPublicAcls: true  # 不用ACL了，直接开启限制
      BlockPublicPolicy: false
      IgnorePublicAcls: true
      RestrictPublicBuckets: false
    BucketEncryption:
      ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: "AES256"
          BucketKeyEnabled: false
    CorsConfiguration:
      CorsRules:
        - AllowedHeaders:
            - "*"
          AllowedMethods:
            - "PUT"
            - "POST"
            - "DELETE"
            - "GET"
          AllowedOrigins:
            - "*"

SomeS3BucketPolicy:
  Type: "AWS::S3::BucketPolicy"
  Properties:
    Bucket: !Ref SomeS3Bucket
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Principal: "*"
          Action: "s3:GetObject"
          Resource: !Sub "${SomeS3Bucket.Arn}/*"

额外要检查的点 #

• 账户级Block Public Access：如果账户全局设置里BlockPublicPolicy或RestrictPublicBuckets是开启状态，哪怕桶级设为false也会生效，得先去AWS控制台的S3全局设置里调整。
• 桶名称唯一性：S3桶名是全球唯一的，要是some-bucket-name已经被别人用了，部署也会失败，建议换成专属的唯一名称。

内容的提问来源于stack exchange，提问作者hpsmn