使用Rails应用写入S3时遇Aws::S3::Errors::AccessDenied问题排查

你的Staging环境S3桶能正常读取、删除文件，但无法写入的问题，根源出在IAM策略的资源ARN拼写错误上。

具体问题点 #

你当前策略中，针对桶内对象的资源ARN写的是：

arn:aws:s3:::naturebooker_staging/*

但你的Staging专用桶名是naturebooker-staging（用的是短横杠-，不是下划线_）。这就导致PutObject这类写入操作的权限没有正确匹配到目标桶的对象资源上——读和删除操作能生效，是因为你对桶本身的ARN（arn:aws:s3:::naturebooker-staging）有对应权限，但写入对象需要的是桶内路径的ARN权限，而你写错了这个路径的桶名部分。

修正后的IAM策略 #

把资源部分的下划线改成短横杠即可，修正后的完整策略如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "s3:PutAnalyticsConfiguration",
        "s3:GetObjectVersionTagging",
        "s3:CreateBucket",
        "s3:ReplicateObject",
        "s3:GetObjectAcl",
        "s3:DeleteBucketWebsite",
        "s3:PutLifecycleConfiguration",
        "s3:GetObjectVersionAcl",
        "s3:PutBucketAcl",
        "s3:PutObjectTagging",
        "s3:DeleteObject",
        "s3:GetIpConfiguration",
        "s3:DeleteObjectTagging",
        "s3:GetBucketWebsite",
        "s3:PutReplicationConfiguration",
        "s3:DeleteObjectVersionTagging",
        "s3:GetBucketNotification",
        "s3:PutBucketCORS",
        "s3:DeleteBucketPolicy",
        "s3:GetReplicationConfiguration",
        "s3:ListMultipartUploadParts",
        "s3:PutObject",
        "s3:GetObject",
        "s3:PutBucketNotification",
        "s3:PutBucketLogging",
        "s3:PutObjectVersionAcl",
        "s3:GetAnalyticsConfiguration",
        "s3:GetObjectVersionForReplication",
        "s3:GetLifecycleConfiguration",
        "s3:ListBucketByTags",
        "s3:GetInventoryConfiguration",
        "s3:GetBucketTagging",
        "s3:PutAccelerateConfiguration",
        "s3:DeleteObjectVersion",
        "s3:GetBucketLogging",
        "s3:ListBucketVersions",
        "s3:ReplicateTags",
        "s3:RestoreObject",
        "s3:ListBucket",
        "s3:GetAccelerateConfiguration",
        "s3:GetBucketPolicy",
        "s3:GetObjectVersionTorrent",
        "s3:AbortMultipartUpload",
        "s3:PutBucketTagging",
        "s3:GetBucketRequestPayment",
        "s3:GetObjectTagging",
        "s3:GetMetricsConfiguration",
        "s3:DeleteBucket",
        "s3:PutBucketVersioning",
        "s3:PutObjectAcl",
        "s3:ListBucketMultipartUploads",
        "s3:PutMetricsConfiguration",
        "s3:PutObjectVersionTagging",
        "s3:GetBucketVersioning",
        "s3:GetBucketAcl",
        "s3:PutInventoryConfiguration",
        "s3:PutIpConfiguration",
        "s3:GetObjectTorrent",
        "s3:ObjectOwnerOverrideToBucketOwner",
        "s3:PutBucketWebsite",
        "s3:PutBucketRequestPayment",
        "s3:GetBucketCORS",
        "s3:PutBucketPolicy",
        "s3:GetBucketLocation",
        "s3:ReplicateDelete",
        "s3:GetObjectVersion"
      ],
      "Resource": [
        "arn:aws:s3:::naturebooker-staging",
        "arn:aws:s3:::naturebooker-staging/*"
      ]
    },
    {
      "Sid": "VisualEditor1",
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:HeadBucket",
        "s3:ListObjects"
      ],
      "Resource": "*"
    }
  ]
}

额外建议 #

• 应用策略后，建议通过AWS IAM Access Analyzer验证权限是否正确匹配，避免类似的拼写错误；
• 如果你不需要这么多S3操作权限，可以根据实际需求精简Action列表，遵循最小权限原则，提升安全性。

内容的提问来源于stack exchange，提问作者Denis Morin