AWS Transfer Service SFTP：禁用目录列表致上传失败的解决方案咨询

需求：配置AWS Transfer Service的SFTP用户，使其能向指定目录data/partner_2/data/incoming/上传文件，但无法查看该目录内的文件列表。当前配置拒绝该目录的s3:ListBucket权限后，上传操作也失败——因为AWS Transfer会在上传前隐式调用ListBucket验证路径。

核心问题分析 #

AWS Transfer Service的SFTP实现为了适配传统FTP的目录逻辑，会在执行put操作前调用s3:ListBucket检查目标路径的“存在性”。直接拒绝该目录所有ListBucket请求，会阻断这一前置验证，导致上传失败。解决方案是精准区分目录结构的列表权限和文件列表权限。

调整后的IAM策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "s3:ListBucket",
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::<my-bucket>",
            "Sid": "AllowDirectoryNavigation",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "data/partner_2/",
                        "data/partner_2/*/",
                        "data/partner_2/data/",
                        "data/partner_2/data/incoming/"
                    ]
                }
            }
        },
        {
            "Action": "s3:ListBucket",
            "Effect": "Deny",
            "Resource": "arn:aws:s3:::<my-bucket>",
            "Sid": "DenyFileListingInIncoming",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "data/partner_2/data/incoming/*"
                    ]
                }
            }
        },
        {
            "Sid": "DenyMkdir",
            "Action": "s3:PutObject",
            "Effect": "Deny",
            "Resource": "arn:aws:s3:::<my-bucket>/*/"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionAcl",
                "s3:PutObjectVersionTagging"
            ],
            "Sid": "AllowReadWriteInIncoming",
            "Resource": "arn:aws:s3:::<my-bucket>/data/partner_2/data/incoming/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Sid": "AllowReadInOutgoing",
            "Resource": "arn:aws:s3:::<my-bucket>/data/partner_2/data/outgoing/*"
        }
    ]
}

策略关键说明 #

• AllowDirectoryNavigation：仅允许列出带末尾斜杠的目录层级前缀，确保用户能通过cd命令导航到incoming目录，但无法触发文件列表请求。
• DenyFileListingInIncoming：明确拒绝列出incoming目录下的文件级前缀（不带末尾斜杠的具体对象路径），实现禁止查看文件列表的需求。
• DenyMkdir：保留原规则，防止用户创建新目录。
• 读写权限：维持原有的incoming目录读写、outgoing目录只读权限配置。

预期验证效果 #

调整后SFTP客户端操作会呈现如下结果：

sftp> cd data/incoming
sftp> ls
Couldn't read directory: Permission denied
sftp> put /Users/foo/Downloads/test.log
Uploading /Users/foo/Downloads/test.log to /data/incoming/test.log
Upload successful
sftp> get test-one.txt
Fetching /data/incoming/test-one.txt to test-one.txt
Fetch successful

内容的提问来源于stack exchange，提问作者Sharath Madappa