禁止错误 403 在直接上传到 S3 时进入控制台

Question

我通过服务器将图像上传到 s3，但由于上传速度快，我想使用直接上传到 S3。 我使用django-s3direct 包直接上传。 我遵循所有步骤，但仍然出现此错误。

上传时控制台出现错误：

POST https://s3-ap-south-1.amazonaws.com/collegestudentworld-assets/img/mainpost/amar.jpg?uploads 403 (Forbidden)

initiate error: collegestudentworld-assets/img/mainpost/amar.jpg AWS Code: AccessDenied, Message:Access Deniedstatus:403

settings.py：

AWS_ACCESS_KEY_ID = os.environ.get('AWS_ACCESS_KEY_ID')
AWS_SECRET_ACCESS_KEY = os.environ.get('AWS_SECRET_ACCESS_KEY')
AWS_STORAGE_BUCKET_NAME =os.environ.get('AWS_STORAGE_BUCKET_NAME')

AWS_S3_ENDPOINT_URL = 'https://s3-ap-south-1.amazonaws.com'
#'http://' + AWS_STORAGE_BUCKET_NAME + '.s3.amazonaws.com/' #"https://collegestudentworld-assets.s3-website.ap-south-1.amazonaws.com/"
AWS_S3_REGION_NAME = 'ap-south-1'
AWS_S3_FILE_OVERWRITE = False
AWS_DEFAULT_ACL = None
STATICFILES_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'

STATIC_URL = 'http://' + AWS_STORAGE_BUCKET_NAME + '.s3.amazonaws.com/'
ADMIN_MEDIA_PREFIX = STATIC_URL + 'admin/'
S3DIRECT_DESTINATIONS = {
    'primary_destination': {
        'key': 'uploads/',
        'allowed': ['image/jpg', 'image/jpeg', 'image/png', 'video/mp4'],
    },
    'mainpost':{
        'key':'img/mainpost/',
        'auth': lambda u:u.is_authenticated
    },
}

存储桶策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions"
            ],
            "Resource": "arn:aws:s3:::collegestudentworld-assets/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:*Object*",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload"
            ],
            "Resource": "arn:aws:s3:::collegestudentworld-assets/*"
        }
    ]
}

CORS 配置：

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
    <AllowedOrigin>http://127.0.0.1:8000</AllowedOrigin>
    <AllowedMethod>PUT</AllowedMethod>
    <AllowedMethod>POST</AllowedMethod>
    <AllowedMethod>DELETE</AllowedMethod>
    <MaxAgeSeconds>3000</MaxAgeSeconds>
    <ExposeHeader>x-amz-server-side-encryption</ExposeHeader>
    <AllowedHeader>*</AllowedHeader>
</CORSRule>
<CORSRule>
    <AllowedOrigin>*.collegestudentworld.com</AllowedOrigin>
    <AllowedMethod>PUT</AllowedMethod>
    <AllowedMethod>POST</AllowedMethod>
    <AllowedMethod>DELETE</AllowedMethod>
    <ExposeHeader>ETag</ExposeHeader>
    <AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>

在我的浏览器控制台中，我得到了这个：

    Starting img/mainpost/amar.jpg reason: first file

    initiate getPayloadSha256Content: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

initiate V4 CanonicalRequest: POST
/collegestudentworld-assets/img/mainpost/amar.jpg
uploads=
content-type:image/jpeg
host:s3-ap-south-1.amazonaws.com
x-amz-acl:public-read
x-amz-date:20200604T125344Z
content-type;host;x-amz-acl;x-amz-date
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
V4 stringToSign: AWS4-HMAC-SHA256
6f90e1d9b91a3e557fe7f531fd735b407e29cc7f28f30655322ab5ad9ae17940
initiate signature: ebd6d06d109fff2ac35f49314a429e57019c48288073e4549d6d4c1b7ec2a10b
initiate getPayloadSha256Content: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

POST https://s3-ap-south-1.amazonaws.com/collegestudentworld-assets/img/mainpost/amar.jpg?uploads 403 (Forbidden)

initiate error: collegestudentworld-assets/img/mainpost/amar.jpg AWS Code: AccessDenied, Message:Access Deniedstatus:403

编辑：

当我将阻止公共访问（存储桶设置）设置为 **OFF 时。然后一切正常。**

但我有私人的用户信息。我不想公开。 可以公开吗..任何想法都比x

Answer 1

如果用户的 IAM 政策设置正确，那么您可以尝试以下这些建议。您可以尝试在存储桶策略中添加 principal 值，而不是 IAM 策略。还要确保Block public access (account settings) 已关闭并且您的存储桶具有公共访问权限。

你可以试试这个解决方案：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3Permissions",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:Get*",
                "s3:List*"
            ],
            "Resource": "arn:aws:s3:::collegestudentworld-assets/*"
        }
    ]
}

您还可以从CORS 设置中删除<AllowedOrigin>http://127.0.0.1:8000</AllowedOrigin>，也可以尝试您的网站或EB 环境名称的完整路径。

 <?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
    <AllowedOrigin>*.collegestudentworld.com</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
</CORSRule>
</CORSConfiguration>

Answer 2

这是我使用的 IAM 政策。我会确保附加到上传策略的 IAM 用户附加了正确的 IAM 策略。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:HeadBucket"
            ],
            "Resource": "arn:aws:s3:::collegestudentworld-assets/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:*Object*",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": "arn:aws:s3:::collegestudentworld-assets/*"
        }
    ]
}