CloudFormation创建S3桶后编写桶策略遇阻，求权限配置方案

Hey there! Let's get your S3 bucket policy sorted out to meet those two permission requirements. First, I noticed your original CloudFormation template was missing the required Resources block (all AWS resources need to live inside this section), so I'll fix that first and then add the bucket policy tailored to your needs.

Here's the complete, updated CloudFormation template that includes both the bucket and the correct policy:

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  BucketName:
    Type: String
    Description: "Choose a name for the S3 Bucket"
    Default: "myrandomnameforbucket"
Resources:
  MyS3Bucket:
    Type: "AWS::S3::Bucket"
    Properties:
      AccessControl: "Private"
      BucketName: !Ref BucketName
  MyBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref MyS3Bucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # Allow UserA to upload files, block delete actions
          - Sid: "AllowUserAUploadNoDelete"
            Effect: "Allow"
            Principal:
              AWS: "arn:aws:iam::YOUR_ACCOUNT_ID:user/UserA"
            Action:
              - "s3:PutObject"
              - "s3:PutObjectAcl"
            Resource: !Sub "arn:aws:s3:::${BucketName}/*"
          - Sid: "DenyUserADelete"
            Effect: "Deny"
            Principal:
              AWS: "arn:aws:iam::YOUR_ACCOUNT_ID:user/UserA"
            Action:
              - "s3:DeleteObject"
              - "s3:DeleteObjectVersion"
            Resource: !Sub "arn:aws:s3:::${BucketName}/*"
          # Grant read access to all internal company users in your AWS account
          - Sid: "AllowInternalUsersReadAccess"
            Effect: "Allow"
            Principal:
              AWS: "arn:aws:iam::YOUR_ACCOUNT_ID:root"
            Action:
              - "s3:GetObject"
              - "s3:ListBucket"
            Resource:
              - !Sub "arn:aws:s3:::${BucketName}"
              - !Sub "arn:aws:s3:::${BucketName}/*"

Let me break down what each part does: #

• Fixed base bucket setup: Wrapped your bucket definition in the Resources block (CloudFormation requires this to recognize it as a deployable resource). Kept your original BucketName parameter and private access control to keep the bucket secure by default.

• UserA's permissions:

  • The first Allow statement lets UserA upload files (s3:PutObject) and set file permissions if needed (s3:PutObjectAcl).
  • The Deny statement explicitly blocks delete actions (both regular delete and versioned object delete). Using Deny here is safer than just not allowing delete, because it overrides any other permissions UserA might inherit from IAM groups or policies.

• Internal company user read access:

  • This statement grants read access to every IAM user in your AWS account (targeting the account root, which propagates to all account users).
  • It allows both listing bucket contents (s3:ListBucket) and downloading files (s3:GetObject) — the two core actions for read-only access. Since this is limited to your account, it stays non-public as you requested.

Quick notes before deploying: #

1. Replace YOUR_ACCOUNT_ID with your actual AWS account ID (you can find this in the AWS Console under My Account).
2. If your internal users are organized in an IAM group instead of individual users, swap the principal ARN to use your group's ARN (e.g., arn:aws:iam::YOUR_ACCOUNT_ID:group/InternalTeamGroup) for cleaner management.
3. If your bucket doesn't have versioning enabled, you can remove s3:DeleteObjectVersion from the deny statement for UserA.

内容的提问来源于stack exchange，提问作者DenCowboy