AWS SNS 编辑主题策略 - C#答案

【问题标题】：AWS SNS edit topic policy - C#AWS SNS 编辑主题策略 - C#
【发布时间】：2018-12-28 00:23:07
【问题描述】：

我有一个 SNS 服务，我正在寻找使用 C# sdk 创建这部分策略的方法：

{
  "Sid": "__console_sub_0",
  "Effect": "Allow",
  "Principal": {
    "AWS": "*"
  },
  "Action": [
    "SNS:Subscribe",
    "SNS:Receive"
  ],
  "Resource": "arn:aws:sns:MYARN"
}

这是我从浏览器控制台设置“允许这些用户向该主题发布消息”和“允许这些用户订阅该主题”时看到的，现在它应该对所有人开放。

我这样做的目的：

Policy snsPolicy = new Policy().WithStatements(
            new Amazon.Auth.AccessControlPolicy.Statement(Amazon.Auth.AccessControlPolicy.Statement.StatementEffect.Allow)
            .WithPrincipals(Principal.AllUsers)
            .WithResources(new Resource("arn:aws:sns:MYARN"))
            );
        SetTopicAttributesRequest setTopicAttributesRequest = new SetTopicAttributesRequest();
        setTopicAttributesRequest.TopicArn = "arn:aws:sns:MYARN";
        setTopicAttributesRequest.AttributeName = "Policy";
        setTopicAttributesRequest.AttributeValue = "test val";

结果：

Invalid parameter: Policy Error: null

  AmazonSimpleNotificationServiceClient snsClient = new AmazonSimpleNotificationServiceClient(bucketRegion);
        snsClient.AuthorizeS3ToPublish("arn:aws:sns:MYARN", "MYBUCKET");

            List<string> tl = new List<string>();
        tl.Add("*");
        List<string> tl2 = new List<string>();
        tl2.Add("SNS:Subscribe"); 
        tl2.Add("SNS:Receive");
        Amazon.SimpleNotificationService.Model.AddPermissionResponse permissionResponse = snsClient.AddPermission("arn:aws:sns:MYARN", "SubscribePolicy", tl, tl2);

结果：

Invalid parameter: Policy statement action out of service scope!

在这两种情况下，我什至不确定这些命令是否正确。谁能让我走上正确的道路？

谢谢

编辑

我创建了一个声明并按照建议将其添加到策略中，并将其用于 SetTopicAttributesRequest：

             AmazonSimpleNotificationServiceClient snsClient = new AmazonSimpleNotificationServiceClient(bucketRegion);            
        Policy snsPolicy = new Policy();
        snsPolicy.Id = "test_id";
        snsPolicy.Statements.Add(statment);
        SetTopicAttributesRequest setTopicAttributesRequest = new SetTopicAttributesRequest();
        setTopicAttributesRequest.TopicArn = "arn:aws:sns:MYARN";
        setTopicAttributesRequest.AttributeName = "Policy";
        setTopicAttributesRequest.AttributeValue = snsPolicy.ToJson();
        snsClient.SetTopicAttributes(setTopicAttributesRequest);

但是报错“Invalid parameter: Policy Error: null”是一样的。

【问题讨论】：

标签： amazon-web-services amazon-sns

【解决方案1】：

根据 AWS 文档，您应该使用在 Amazon.Auth.AccessControlPolicy 中找到的 Policy 对象

以下代码创建策略对象。对于这种情况，您只需要一个语句。它具有存储桶 + 用户名和 GET 和 PUT 操作的资源。作为一项附加的安全措施，让我们添加一个条件，将 GET 和 PUT 请求锁定到桌面客户端的 IP 地址。

public Policy GeneratePolicy(string bucket, string username, string ipAddress)
{
    var statement = new Statement(Statement.StatementEffect.Allow);

    // Allow access to the sub folder represented by the username in the bucket
    statement.Resources.Add(ResourceFactory.NewS3ObjectResource(bucket, username + "/*"));

    // Allow Get and Put object requests.
    statement.Actions = new List() 
        { S3ActionIdentifiers.GetObject,  S3ActionIdentifiers.PutObject };

    // Lock the requests coming from the client machine.
    statement.Conditions.Add(ConditionFactory.NewIpAddressCondition(ipAddress));

    var policy = new Policy();
    policy.Statements.Add(statement);

    return policy;
}

查看此link 了解更多信息。

【讨论】：