使用AWS Backup备份S3 Bucket时遭遇Access Denied错误求助

问题描述 #

使用AWS Backup工具备份S3 Bucket时持续收到Access Denied错误，确认是Bucket Policy导致，删除该策略后备份恢复正常。当前Bucket Policy如下：

{
    "Version": "2012-10-17",
    "Id": "Policy1558438618388",
    "Statement": [
        {
            "Sid": "Stmt1558438593926",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::<bucket-name-here>",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "<some-ip-address>/32",
                        "<some-ip-address>/32",
                        "<some-ip-address>/32",
                        "<some-ip-address>/32"
                    ]
                },
                "ArnNotEquals": {
                    "aws:username": [
                        "arn:aws:iam::<some-user-arn>",
                        "arn:aws:iam::<some-user-arn>",
                        "arn:aws:iam::<some-user-arn>",
                        "arn:aws:iam::<some-user-arn>"
                    ]
                }
            }
        }
    ]
}

问题根源 #

1. 条件键错误：原策略中ArnNotEquals使用了aws:username条件键，该键对应IAM用户的用户名（如admin）而非ARN，导致指定的IAM用户ARN无法被正确匹配，Deny规则实际仅基于IP地址限制——只要请求来源IP不在指定列表，就会被拒绝所有S3操作。
2. AWS Backup未被豁免：AWS Backup通过backup.amazonaws.com服务主体发起请求，其来源IP不在指定列表中，且对应的服务角色也不在原策略允许范围内，因此触发了Deny规则。

修复后的Bucket Policy #

将原策略修改为以下内容，即可允许AWS Backup正常执行备份：

{
    "Version": "2012-10-17",
    "Id": "Policy1558438618388",
    "Statement": [
        {
            "Sid": "Stmt1558438593926",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::<bucket-name-here>",
                "arn:aws:s3:::<bucket-name-here>/*"
            ],
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "<some-ip-address>/32",
                        "<some-ip-address>/32",
                        "<some-ip-address>/32",
                        "<some-ip-address>/32"
                    ]
                },
                "ArnNotEquals": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::<some-user-arn>",
                        "arn:aws:iam::<some-user-arn>",
                        "arn:aws:iam::<some-user-arn>",
                        "arn:aws:iam::<some-user-arn>"
                    ]
                },
                "StringNotEquals": {
                    "aws:PrincipalService": "backup.amazonaws.com"
                }
            }
        }
    ]
}

修改说明 #

• 修正条件键：将aws:username替换为aws:PrincipalArn，确保指定的IAM用户ARN能被正确匹配，Deny规则仅针对非指定用户、非指定IP且非AWS Backup的请求生效。
• 添加对象资源：在Resource中添加arn:aws:s3:::<bucket-name-here>/*，确保Bucket内的对象操作也受策略管控（AWS Backup需要读取对象内容进行备份）。
• 豁免AWS Backup：新增StringNotEquals条件，排除backup.amazonaws.com服务主体，让AWS Backup的请求不受Deny规则限制。

内容的提问来源于stack exchange，提问作者mathrixx