能否在AWS S3资源端配置仅允许指定IAM角色读取存储桶？

Absolutely, this is totally doable! The confusion likely stems from the AWS Console not having a direct point-and-click option for this exact scenario, but you can absolutely lock down read access to your S3 bucket exclusively for the role_xyz, role_abc, and role_cde IAM roles by manually creating a custom bucket policy.

具体实现步骤： #

1. 进入存储桶策略编辑器
   在AWS控制台打开你的S3存储桶，切换到「权限」标签页，找到「存储桶策略」板块，点击「编辑」。

2. 使用以下自定义策略模板
   将占位符替换为你的实际信息（ACCOUNT_ID替换成你的AWS账号ID，YOUR_BUCKET_NAME替换成存储桶名称），然后粘贴这段JSON策略：

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": [
             "arn:aws:iam::ACCOUNT_ID:role/role_xyz",
             "arn:aws:iam::ACCOUNT_ID:role/role_abc",
             "arn:aws:iam::ACCOUNT_ID:role/role_cde"
           ]
         },
         "Action": [
           "s3:Get*",
           "s3:List*"
         ],
         "Resource": [
           "arn:aws:s3:::YOUR_BUCKET_NAME",
           "arn:aws:s3:::YOUR_BUCKET_NAME/*"
         ]
       },
       {
         "Effect": "Deny",
         "NotPrincipal": {
           "AWS": [
             "arn:aws:iam::ACCOUNT_ID:role/role_xyz",
             "arn:aws:iam::ACCOUNT_ID:role/role_abc",
             "arn:aws:iam::ACCOUNT_ID:role/role_cde",
             "arn:aws:iam::ACCOUNT_ID:root"
           ]
         },
         "Action": "s3:*",
         "Resource": [
           "arn:aws:s3:::YOUR_BUCKET_NAME",
           "arn:aws:s3:::YOUR_BUCKET_NAME/*"
         ]
       }
     ]
   }
   

策略说明： #

• 第一条Allow语句：授予指定的三个IAM角色对存储桶及其中对象的完整只读权限（通过s3:Get*和s3:List*动作实现）。
• 第二条Deny语句：拒绝所有不在允许列表内的主体执行任何S3操作。这里特意包含了根用户，确保你作为存储桶所有者能保留完整的管理权限。

关键注意事项： #

• 确保存储桶的ACL保持默认的「私有」设置，避免与存储桶策略产生冲突。
• 仔细核对IAM角色的ARN格式，必须完全准确（格式为arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME）。
• 确认允许的角色没有其他明确拒绝访问该存储桶的IAM策略（拒绝策略优先级高于允许策略）。

内容的提问来源于stack exchange，提问作者huican