CloudFront自动添加S3策略后IAM用户/角色无法执行HeadObject操作求助

问题描述 #

CloudFront自动添加S3 Bucket策略后，IAM用户及生产环境IAM角色无法访问该Bucket执行HeadObject操作。已尝试配置Principal但无效，且该IAM用户已拥有S3全权限。

原Bucket策略 #

{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "Server access",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ],
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:iam::1234567890:user/dev"
                }
            }
        },
        {
            "Sid": "AllowCloudFrontServicePrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::1234567890:distribution/asdf"
                }
            }
        }
    ]
}

问题分析 #

1. 策略使用旧版本2008-10-17，权限控制能力有限
2. 未将s3:HeadObject加入允许操作列表，导致无法执行该操作
3. 第一个Statement通过AWS:SourceArn仅限制指定IAM用户访问，生产环境IAM角色的ARN不匹配该条件，无法获得权限
4. 原策略的Principal配置为*加条件限制，不如直接指定授权主体清晰，容易出现匹配问题

修改后的Bucket策略 #

{
    "Version": "2012-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "AllowIAMUsersAndRoles",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::1234567890:user/dev",
                    "arn:aws:iam::1234567890:role/production-role"
                ]
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:HeadObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        },
        {
            "Sid": "AllowCloudFrontServicePrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::1234567890:distribution/asdf"
                }
            }
        }
    ]
}

修改说明 #

1. 升级策略版本至2012-10-17，这是AWS推荐使用的最新策略版本，支持更灵活的权限配置
2. 明确指定需要授权的IAM用户和角色ARN到Principal列表中，避免原条件匹配问题导致的权限失败
3. 添加s3:HeadObject操作到允许列表，直接解决无法执行该操作的问题
4. 保留CloudFront服务主体的访问权限，确保CDN正常拉取Bucket内容

内容的提问来源于stack exchange，提问作者acw