如何编写符合指定CloudFront与S3权限要求的自定义AWS IAM策略

现有策略不符合要求的问题点 #

• 缺失所有CloudFront服务的权限配置，完全无法实现对cloudfront.abc.com的读写访问需求
• 第一条S3权限使用s3:*作用于桶资源，包含了s3:DeleteBucket删除存储桶的权限，违反了不得删除abc-ftp桶本身的要求
• 第二条S3权限包含大量超出需求的操作：例如账户级公共访问块配置、存储透镜配置、多区域接入点操作等，同时包含ListAllMyBuckets权限可查看账户下所有存储桶，不符合"仅对abc-ftp存储桶拥有权限"的约束

符合要求的最终策略 #

你需要将策略中${AWS_ACCOUNT_ID}替换为你的AWS账户12位数字ID，${CLOUDFRONT_DIST_ID}替换为cloudfront.abc.com对应的CloudFront分发ID（可在CloudFront控制台查看对应域名的分发ID）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCloudFrontReadWriteForTargetDomain",
            "Effect": "Allow",
            "Action": [
                "cloudfront:Get*",
                "cloudfront:List*",
                "cloudfront:Update*",
                "cloudfront:CreateInvalidation",
                "cloudfront:TagResource",
                "cloudfront:UntagResource"
            ],
            "Resource": "arn:aws:cloudfront::${AWS_ACCOUNT_ID}:distribution/${CLOUDFRONT_DIST_ID}"
        },
        {
            "Sid": "AllowS3BucketLevelOperationsExceptDelete",
            "Effect": "Allow",
            "Action": [
                "s3:GetAccelerateConfiguration",
                "s3:GetAnalyticsConfiguration",
                "s3:GetBucketAcl",
                "s3:GetBucketCORS",
                "s3:GetBucketLocation",
                "s3:GetBucketLogging",
                "s3:GetBucketNotification",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketOwnershipControls",
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketRequestPayment",
                "s3:GetBucketTagging",
                "s3:GetBucketVersioning",
                "s3:GetBucketWebsite",
                "s3:GetEncryptionConfiguration",
                "s3:GetIntelligentTieringConfiguration",
                "s3:GetInventoryConfiguration",
                "s3:GetLifecycleConfiguration",
                "s3:GetMetricsConfiguration",
                "s3:GetReplicationConfiguration",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions",
                "s3:ListMultipartUploadParts",
                "s3:PutAccelerateConfiguration",
                "s3:PutAnalyticsConfiguration",
                "s3:PutBucketAcl",
                "s3:PutBucketCORS",
                "s3:PutBucketLogging",
                "s3:PutBucketNotification",
                "s3:PutBucketObjectLockConfiguration",
                "s3:PutBucketOwnershipControls",
                "s3:PutBucketPolicy",
                "s3:PutBucketPublicAccessBlock",
                "s3:PutBucketRequestPayment",
                "s3:PutBucketTagging",
                "s3:PutBucketVersioning",
                "s3:PutBucketWebsite",
                "s3:PutEncryptionConfiguration",
                "s3:PutIntelligentTieringConfiguration",
                "s3:PutInventoryConfiguration",
                "s3:PutLifecycleConfiguration",
                "s3:PutMetricsConfiguration",
                "s3:PutReplicationConfiguration"
            ],
            "Resource": "arn:aws:s3:::abc-ftp"
        },
        {
            "Sid": "AllowS3ObjectFullOperations",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectTagging",
                "s3:DeleteObjectVersion",
                "s3:DeleteObjectVersionTagging",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectRetention",
                "s3:GetObjectTagging",
                "s3:GetObjectTorrent",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectVersionTorrent",
                "s3:ObjectOwnerOverrideToBucketOwner",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectLegalHold",
                "s3:PutObjectRetention",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionAcl",
                "s3:PutObjectVersionTagging",
                "s3:RestoreObject"
            ],
            "Resource": "arn:aws:s3:::abc-ftp/*"
        },
        {
            "Sid": "DenyDeleteAbcFtpBucket",
            "Effect": "Deny",
            "Action": "s3:DeleteBucket",
            "Resource": "arn:aws:s3:::abc-ftp"
        }
    ]
}

策略说明 #

• 新增的CloudFront权限仅开放目标分发的读写操作，不包含删除分发的权限
• S3桶级权限显式排除了删除桶操作，同时额外增加了Deny规则做双重防护，确保无法删除abc-ftp存储桶
• 移除了所有非必要的全局S3操作，仅保留abc-ftp桶及桶内对象的相关权限，符合最小权限原则

内容的提问来源于stack exchange，提问作者santosh baruah