跨账户中的 Amazon S3 文件“拒绝访问”异常

Question

我有 2 个 AWS 账户。账户 A 有 S3 存储桶“BUCKET”，我使用 Java api 将文件放入其中。我已将我的“BUCKET”策略配置为允许跨账户文件发布。 但是，当我尝试从帐户 A 打开此文件时，它显示 AccessDeniedAccess Denied with hostId 和 requestId。

这个文件是通过账户B使用java api发布的，这个文件和通过api发布的文件大小相同。我尝试更改文件大小，新大小显示在 AWS S3 控制台上。 这是我的存储桶政策：

    {
"Version": "2008-10-17",
"Id": "Policy1357935677554",
"Statement": [
    {
        "Sid": "Stmt1357935647218",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTB:user/accountb-user"
        },
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::bucket-name"
    },
    {
        "Sid": "Stmt1357935676138",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTB:user/accountb-user"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::bucket-name/*"
    },
    {
        "Sid": "Stmt1357935676138",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTB:user/accountb-user"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::bucket-name/*"
    },
    {
        "Sid": "Stmt1357935647218",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTA:user/accounta-user"
        },
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::bucket-name"
    },
    {
        "Sid": "Stmt1357935676138",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTA:user/accounta-user"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::bucket-name/*"
    },
    {
        "Sid": "Stmt1357935676138",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::ACCOUNTA:root"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::bucket-name/*"
    }
]

}

问题是当我尝试从帐户 A 下载/打开此文件时，我无法打开它。

Answer 1

问题在于，默认情况下，当 AWS（cli 或 SDK）上传文件时，它仅通过 s3 ACL 授予上传者访问权限。

在这种情况下，要允许所有者读取上传的文件，上传者必须在上传期间明确授予存储桶所有者的访问权限。例如：

• 使用aws CLI（文档here）：aws s3api put-object --bucket <bucketname> --key <filename> --acl bucket-owner-full-control
• 使用nodejs API（文档here）：您必须将AWS.S3.upload 方法的params.ACL 属性设置为"bucket-owner-full-control"

同时，您还可以确保 Bucket Owner 对存储桶策略具有完全控制权，（附加文档here）：

{ "Version": "2012-10-17", "Statement": [ { "Sid": "Grant Owner Full control dev", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::ACCOUNTB:root" }, "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws:s3:::bucket-name/*" ], "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] }