如何配置S3策略拒绝AWS Transfer Family访问特定文件夹的所有操作？

你的策略无法阻止列出受限文件夹内容，核心原因是S3的ListBucket是桶级操作，权限判断基于桶的ARN（arn:aws:s3:::${bucket_name}），而非对象路径。你当前的Deny语句仅针对对象级资源（带/*的路径），无法覆盖桶级的ListBucket操作，因此允许列出受限文件夹的权限仍然生效。

修改后的策略方案 #

方案1：在ListBucket允许语句中排除受限前缀 #

通过Condition限制仅能列出非受限路径的内容：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:GetBucketAcl"
      ],
      "Resource": "arn:aws:s3:::${bucket_name}",
      "Condition": {
        "StringNotLike": {
          "s3:prefix": [
            "app/restricted/*",
            "app/restricted"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:GetObjectAcl",
        "s3:GetObjectVersionTagging",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws:s3:::${bucket_name}/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::${bucket_name}/app/restricted",
        "arn:aws:s3:::${bucket_name}/app/restricted/*"
      ]
    }
  ]
}

方案2：添加专门的Deny规则阻止ListBucket访问受限前缀 #

针对桶级操作单独设置Deny条件：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:GetBucketAcl"
      ],
      "Resource": "arn:aws:s3:::${bucket_name}"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:GetObjectAcl",
        "s3:GetObjectVersionTagging",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws:s3:::${bucket_name}/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::${bucket_name}/app/restricted",
        "arn:aws:s3:::${bucket_name}/app/restricted/*"
      ]
    },
    {
      "Effect": "Deny",
      "Action": [
        "s3:ListBucket",
        "s3:ListBucketVersions"
      ],
      "Resource": "arn:aws:s3:::${bucket_name}",
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "app/restricted/*",
            "app/restricted"
          ]
        }
      }
    }
  ]
}

效果验证 #

修改后执行aws s3 ls s3://sample_bucket/app/restricted/data会返回访问拒绝，符合预期。

内容的提问来源于stack exchange，提问作者Ravichandran