如何合并S3存储桶策略语句？实现账号或User Agent访问控制

我有一个S3存储桶，需要实现以下访问控制规则：

• 允许携带特定User Agent（user_agent1、user_agent2）的任何人访问存储桶内对象
• 允许指定AWS账号ID（1、2）下的用户无需验证User Agent即可访问

目前已有分别满足单个条件的独立策略，现需将它们合并为一个可同时满足上述两个条件的存储桶策略。

现有基于User Agent的策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "allow-username-and-password-access",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::dumps/*",
            "Condition": {
                "ForAllValues:StringNotEquals": {
                    "aws:UserAgent": [
                        "user_agent1",
                        "user_agent2"
                    ]
                }
            }
        }
    ]
}

现有基于AWS账号ID的策略 #

{
"Version": "2012-10-17",
"Id": "Policy1606557924566",
"Statement": [
    {
        "Sid": "Stmt1606557921184",
        "Effect": "Allow",
        "Principal": {
            "AWS": ["arn:aws:iam::1:user","arn:aws:iam::2:user"]
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::dumps/*"
    }
]
}

可以通过添加两个Allow类型的Statement实现需求，AWS会自动处理"任一条件满足即允许"的逻辑：

{
    "Version": "2012-10-17",
    "Id": "CombinedBucketAccessPolicy",
    "Statement": [
        {
            "Sid": "AllowSpecifiedAccounts",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::1:user",
                    "arn:aws:iam::2:user"
                ]
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::dumps/*"
        },
        {
            "Sid": "AllowValidUserAgents",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::dumps/*",
            "Condition": {
                "StringEquals": {
                    "aws:UserAgent": [
                        "user_agent1",
                        "user_agent2"
                    ]
                }
            }
        }
    ]
}

策略说明 #

• 第一个Statement（AllowSpecifiedAccounts）：直接授权指定AWS账号下的用户对存储桶内对象执行s3:GetObject操作，无附加条件
• 第二个Statement（AllowValidUserAgents）：授权所有用户执行s3:GetObject操作，但仅当请求的User Agent匹配user_agent1或user_agent2时生效
• 两个Statement均为Allow类型，只要满足任一条件，访问就会被允许，完全匹配需求

注意：原User Agent策略采用Deny逻辑存在风险——Deny优先级高于所有Allow规则，可能会意外阻止合法访问，改用Allow+条件的方式逻辑更直观，也更安全。

内容的提问来源于stack exchange，提问作者Henley Wing Chiu