S3 Private Bucket

我正在嘗試創建一個有限訪問權的私人S3存儲桶。我只想讓自己成爲用戶和EC2角色來訪問存儲桶。存儲桶的目的是存儲將被複制到自動調節組中的計算機上的加密SSH密鑰。現在，當我運行對鬥AWS同步，這裏是輸出：S3 Private Bucket

[email protected]:~$ aws s3 sync s3://sshfolder.companycloud.com/cogility /home/cogility/.ssh 
download failed: s3://sshfolder.companycloud.com/cogility/id_rsa to ../cogility/.ssh/id_rsa An error occurred (AccessDenied) when calling the GetObject operation: Access Denied 
download failed: s3://sshfolder.companycloud.com/cogility/id_rsa.pub to ../cogility/.ssh/id_rsa.pub An error occurred (AccessDenied) when calling the GetObject operation: Access Denied

我創建EC2實例與EC2角色具有以下權限：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Sid": "", 
      "Effect": "Allow", 
      "Action": [ 
       "kms:List*", 
       "kms:Get*", 
       "kms:Describe*" 
      ], 
      "Resource": "arn:aws:kms:us-west-2:0000000000:key/kms-id-" 
     }, 
     { 
      "Sid": "", 
      "Effect": "Allow", 
      "Action": "s3:*", 
      "Resource": [ 
       "arn:aws:s3:::sshfolder.companycloud.com/*", 
       "arn:aws:s3:::sshfolder.companycloud.com" 
      ] 
     }, 
     { 
      "Sid": "", 
      "Effect": "Allow", 
      "Action": [ 
       "elasticloadbalancing:*", 
       "ec2:*", 
       "cloudwatch:*", 
       "autoscaling:*" 
      ], 
      "Resource": "*" 
     }, 
     { 
      "Sid": "", 
      "Effect": "Allow", 
      "Action": [ 
       "lambda:List*", 
       "lambda:Invoke*", 
       "lambda:Get*" 
      ], 
      "Resource": "*" 
     } 
    ] 
}

這裏是鬥政策：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Effect": "Deny", 
      "Principal": "*", 
      "Action": "s3:*", 
      "Resource": [ 
       "arn:aws:s3:::sshfolder.companycloud.com", 
       "arn:aws:s3:::sshfolder.companycloud.com/*" 
      ], 
      "Condition": { 
       "StringNotLike": { 
        "aws:userId": [ 
         "AROAXXXXXXXXXXXXXXXXX", <-- autoscaling-ec2-role user id 
         "AROAXXXXXXXXXXXXXXXXX", 
         "AIDAXXXXXXXXXXXXXXXXX", 
         "AIDAXXXXXXXXXXXXXXXXX" 
        ], 
        "aws:sourceVpce": "vpce-abc82480d" 
       }, 
       "ArnNotLike": { 
        "aws:SourceArn": "arn:aws:sts::000000000000:assumed-role/autoscaling-ec2-role/" 
       } 
      } 
     }, 
     { 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": "arn:aws:iam::000000000000:root" 
      }, 
      "Action": "s3:*", 
      "Resource": [ 
       "arn:aws:s3:::sshfolder.companycloud.com", 
       "arn:aws:s3:::sshfolder.companycloud.com/*" 
      ] 
     } 
    ] 
}

任何想法爲什麼我無法從我的EC2實例訪問S3存儲桶？

來源

2017-08-06 fnwede

否決特權允許您的存儲桶政策。你需要使用不是主體來實現這一點。

"Statement": [ 
    { 
     "Effect": "Deny", 
     "NotPrincipal": { 
      "AWS": "arn:aws:iam::000000000000:root" 
     }, 
     "Action": "s3:*", 
     "Resource": [ 
      "arn:aws:s3:::sshfolder.companycloud.com", 
      "arn:aws:s3:::sshfolder.companycloud.com/*" 
     ], 
     "Condition": { 
      "StringNotLike": { 
       "aws:userId": [ 
        "AROAXXXXXXXXXXXXXXXXX", <-- autoscaling-ec2-role user id 
        "AROAXXXXXXXXXXXXXXXXX", 
        "AIDAXXXXXXXXXXXXXXXXX", 
        "AIDAXXXXXXXXXXXXXXXXX" 
       ], 
       "aws:sourceVpce": "vpce-abc82480d" 
      }, 
      "ArnNotLike": { 
       "aws:SourceArn": "arn:aws:sts::000000000000:assumed-role/autoscaling-ec2-role/" 
      } 
     } 
    } 
]

它只是反轉主元素。您可以根據需要類似地使用NotAction和NotResource。你可以完全廢除你的條件，只用NotPrincipal來處理它們，這通常比條件更好。

這裏是它的資源：https://aws.amazon.com/blogs/security/how-to-create-a-policy-that-whitelists-access-to-sensitive-amazon-s3-buckets/

來源

2017-08-06 19:37:52 bryan60

亞馬遜S3水桶在默認情況下私人。因此，一個辦法是：

不要使用桶政策
將權限添加到您的IAM用戶和IAM角色訪問鬥

或者：

使用存儲桶策略授予對IAM用戶和IAM角色的訪問權

兩者都足以滿足您的需求。

但是，如果你還偏執地認爲有人可能不小心授權訪問桶（例如用s3:*和*主），那麼你的明確拒絕訪問比用戶&角色以外的其他人的做法是一個好方法。

來源

2017-08-07 01:23:07

回答

相關問題