Flutter使用AWS Amplify Storage访问已有S3存储桶的无登录读取问题

第一步：S3存储桶侧权限配置 #

• 关闭存储桶「阻止公开访问」的全部4项配置，仅开放只读相关权限，禁止开放写入权限
• 配置桶策略，仅授予匿名用户列表、读取权限，参考配置如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicListGet",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::替换为你的实际桶名",
                "arn:aws:s3:::替换为你的实际桶名/*"
            ]
        }
    ]
}

• 配置CORS规则，允许Flutter应用访问，参考配置如下：

[
    {
        "AllowedHeaders": ["*"],
        "AllowedMethods": ["GET", "HEAD"],
        "AllowedOrigins": ["*"], // 生产环境请替换为应用实际域名，避免被恶意爬取
        "ExposeHeaders": []
    }
]

第二步：Flutter Amplify 配置调整 #

• 修改amplifyconfiguration.dart中Storage模块的默认访问权限为guest，参考配置片段：

const amplifyconfig = '''{
  "UserAgent": "aws-amplify-cli/2.0",
  "Version": "1.0",
  "storage": {
    "plugins": {
      "awsS3": {
        "bucket": "替换为你的实际桶名",
        "region": "替换为桶所属区域",
        "defaultAccessLevel": "guest"
      }
    }
  }
}''';

• Amplify初始化时无需引入Auth插件，仅引入Storage插件即可：

import 'package:amplify_flutter/amplify_flutter.dart';
import 'package:amplify_storage_s3/amplify_storage_s3.dart';

Future<void> configureAmplify() async {
  final storage = AmplifyStorageS3();
  try {
    await Amplify.addPlugin(storage);
    await Amplify.configure(amplifyconfig);
  } on Exception catch (e) {
    print('Amplify配置失败: $e');
  }
}

第三步：核心功能实现 #

列出桶内文件 #

Future<List<StorageItem>> listS3Files() async {
  try {
    final result = await Amplify.Storage.list();
    return result.items;
  } on StorageException catch (e) {
    print('列出文件失败: $e');
    rethrow;
  }
}

获取文件访问链接 #

Future<String> getFileAccessUrl(String fileKey) async {
  try {
    final result = await Amplify.Storage.getUrl(
      key: fileKey,
      options: const StorageGetUrlOptions(
        accessLevel: StorageAccessLevel.guest,
      ),
    );
    return result.url.toString();
  } on StorageException catch (e) {
    print('获取文件链接失败: $e');
    rethrow;
  }
}

注意：生产环境建议严格限制CORS的允许来源域名，避免存储桶被恶意爬取产生超额费用。如果对安全性要求更高，可选择在后端生成S3预签名URL返回给前端调用，无需直接公开存储桶权限。

内容的提问来源于stack exchange，提问作者RJB