AWS S3基于用户名限制用户仅访问bucket3同名目录的策略配置问题

问题根源 #

你当前策略报错的核心原因有两个：

1. 如果你是直接用当前策略替换了原有授予S3全访问权限的组策略，那么除了策略中明确写的允许操作外，其他所有S3桶的操作都属于隐式拒绝，自然会出现所有桶都无法访问的问题。
2. 即使是叠加在原有全访问策略之上，你写的Deny语句逻辑也存在缺陷：s3:prefix 条件键仅对桶级别的 s3:ListBucket 操作生效，对对象级别的Put/Delete/Get等操作完全不识别，会导致条件判断逻辑失效，无法正确限制bucket3的访问。

修正后的完整策略 #

如果你希望替换原有组策略，同时保留其他9个桶的全访问权限，只限制bucket3的访问，直接使用下面的策略即可：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowBasicConsoleNavigation",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "AllowFullAccessToOtherBuckets",
            "Effect": "Allow",
            "Action": "s3:*",
            "NotResource": [
                "arn:aws:s3:::bucket3",
                "arn:aws:s3:::bucket3/*"
            ]
        },
        {
            "Sid": "AllowBucket3BasePathListing",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::bucket3",
            "Condition": {
                "StringEquals": {
                    "s3:prefix": ["", "report/"],
                    "s3:delimiter": "/"
                }
            }
        },
        {
            "Sid": "AllowListOwnUserFolder",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::bucket3",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "report/user=${aws:username}/*",
                        "report/user=${aws:username}"
                    ]
                }
            }
        },
        {
            "Sid": "AllowFullAccessToOwnObjects",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::bucket3/report/user=${aws:username}/*"
        }
    ]
}

叠加限制策略方案（无需修改原有全访问组策略） #

如果你不想改动已有的S3全访问组策略，只需要额外叠加下面的限制策略即可：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAccessToOtherUsersFolderInBucket3",
            "Effect": "Deny",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::bucket3",
                "arn:aws:s3:::bucket3/*"
            ],
            "Condition": {
                "StringNotLike": {
                    "s3:prefix": [
                        "",
                        "report/",
                        "report/user=${aws:username}",
                        "report/user=${aws:username}/*"
                    ]
                },
                "StringNotEqualsIfExists": {
                    "s3:delimiter": "/"
                },
                "ArnNotLikeIfExists": {
                    "s3:ObjectArn": "arn:aws:s3:::bucket3/report/user=${aws:username}/*"
                }
            }
        }
    ]
}

注意事项 #

• 策略中的${aws:username}会自动替换为当前请求的AWS用户名，无需手动修改
• 如果你使用的是IAM身份中心（SSO）用户，需要把${aws:username}替换为${aws:principalTag:preferred_username}或者对应存放用户名的属性标签

内容的提问来源于stack exchange，提问作者amar