S3 存储：将存储桶文件夹设为私有

Question

我的 s3 存储设置如下所示：

权限 > 存储桶策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        }
    ]
}

每个对象都是公开的。

我有 3 个文件夹，想添加一个新的私有文件夹。我如何确保它是私密的？

Answer 1

您必须使用名为NotResource 的选项。

The NotResource element lets you grant or deny access to all but a few
of your resources, by allowing you to specify only those resources to
which your policy should not be applied.

因此，您应该使用NotResource 而不是Resource。 有了这个，你的 存储桶策略应该是：

{
    "Sid": "AllowPublicReadWithPrivateFolder",
    "Effect": "Allow",
    "NotResource": "arn:aws:s3:::bucket/your_private_folder_path/*",
    "Principal": {
        "AWS": [
        "*"
        ]
    },
    "Action": "s3:GetObject"        
}

Link to reference