无法为S3存储桶同时配置域名防盗链与Zencoder存储桶策略咨询

问题核心原因 #

• AWS S3单个存储桶仅支持绑定1份策略文档，不可同时上传两个独立策略，必须将两组规则合并到同一策略的Statement数组内
• 之前将域名referer条件添加到Zencoder规则中导致失效，是因为Zencoder发起的S3请求不会携带aws:Referer请求头，加了条件后Zencoder的请求直接不符合规则被拦截，同时原有公众访问s3:GetObject的规则未保留，最终导致两个策略都失效。

正确合并后的存储桶策略 #

请将下方策略中所有YOUR_ACTUAL_BUCKET_NAME替换为你的真实S3存储桶名称后直接上传即可：

{
    "Version": "2012-10-17",
    "Id": "MergedRefererAndZencoderPolicy",
    "Statement": [
        {
            "Sid": "AllowGetFromSpecifiedReferer",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOUR_ACTUAL_BUCKET_NAME/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": "https://www.vlogmo.com/*"
                }
            }
        },
        {
            "Sid": "ZencoderObjectAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::395540211253:root"
            },
            "Action": [
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:PutObjectAcl",
                "s3:PutObject",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": "arn:aws:s3:::YOUR_ACTUAL_BUCKET_NAME/*"
        },
        {
            "Sid": "ZencoderBucketAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::395540211253:root"
            },
            "Action": [
                "s3:ListBucketMultipartUploads",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::YOUR_ACTUAL_BUCKET_NAME"
        }
    ]
}

生效说明 #

两组规则独立校验互不干扰：

• 普通用户的对象读取请求，必须符合referer域名限制才可访问
• Zencoder的服务账号请求不受referer条件限制，可正常完成转码相关的读写操作

内容的提问来源于stack exchange，提问作者tony Macias