Bucket Policy报错：Action不匹配资源，请求社区协助排查

Hey there! Let's break down why your new bucket policy is throwing that frustrating error. Even though you've assigned resources to each statement, the most common culprit is a mismatch between the S3 actions you're defining and the resource ARNs you've specified. Here are the key things to check:

1. Action vs. Resource Type Mismatch #

S3 actions fall into two distinct categories, each requiring a specific resource ARN format:

• Bucket-level actions: These operate on the bucket itself (e.g., s3:ListBucket, s3:PutBucketPolicy). They need the bucket ARN without the trailing /*:

  arn:aws:s3:::your-bucket-name
  

• Object-level actions: These target individual objects inside the bucket (e.g., s3:GetObject, s3:PutObject). They require the bucket ARN with /* to cover all objects:

  arn:aws:s3:::your-bucket-name/*
  

If you pair a bucket-level action with an object ARN (or vice versa), AWS will throw the "Action does not apply to any resource" error. For example, using s3:ListBucket with arn:aws:s3:::my-bucket/* is invalid—this action only works on the bucket itself.

2. Typos or Invalid ARN Format #

Double-check your resource ARNs for small, easy-to-miss mistakes:

• Missing colons (e.g., arn:aws:s3::my-bucket instead of arn:aws:s3:::my-bucket)
• Incorrect bucket name (case sensitivity matters—S3 bucket names are lowercase in most regions)
• Extra characters or typos in the ARN structure

3. Misspelled or Unsupported Actions #

Even with the official policy generator, typos can slip in when copying the policy. Verify each action name against AWS's official S3 action reference to ensure it exists and is spelled correctly. For example, s3:GetObjec (missing a "t") would trigger this error.

4. Conflicting Conditions (If Applicable) #

If your new policy includes conditions (like aws:SourceIp or aws:PrincipalTag), make sure those conditions don't inadvertently exclude all possible resources. For example, a source IP condition that doesn't match your actual IP would make the action effectively apply to no resources.

Quick Fix Example #

Here's a common mistake and how to correct it:

Invalid Statement #

{
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::123456789012:user/your-specific-user"},
  "Action": "s3:ListBucket",
  "Resource": "arn:aws:s3:::your-bucket/*" // Wrong resource for ListBucket
}

Corrected Statement #

{
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::123456789012:user/your-specific-user"},
  "Action": "s3:ListBucket",
  "Resource": "arn:aws:s3:::your-bucket" // Correct resource for bucket-level action
}

Pro Tip #

Use the IAM Access Analyzer to validate your bucket policy. It will highlight exactly which statements have action-resource mismatches and explain why—saving you a ton of time debugging manually.

内容的提问来源于stack exchange，提问作者Andres Urrego Angel