通過節點SDK在AWS上覆制文件時發生「訪問被拒絕」

Question

我目前正在Node中編寫一個應用程序，該應用程序必須能夠創建，刪除和複製存儲桶中的文件。創建和刪除功能就像一個魅力，但問題是'copyObject'功能（http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.html#copyObject-property）。它返回一個錯誤，說'訪問被拒絕'。

我做了一些研究，並嘗試了不同的桶策略，但似乎沒有任何工作。這是我目前使用的政策：

{ 
    "Version": "2008-10-17", 
    "Id": "Policy1458587151478", 
    "Statement": [ 
     { 
      "Sid": "AllowPublicRead", 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": "*" 
      }, 
      "Action": "s3:GetObject", 
      "Resource": "arn:aws:s3:::bucketname/*" 
     }, 
     { 
      "Sid": "AllowPublicList", 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": "*" 
      }, 
      "Action": "s3:ListBucket", 
      "Resource": "arn:aws:s3:::bucketname" 
     } 
    ] 
} 

（其中bucketname是我的桶的名稱）

我用它來複制文件中的代碼是：

copyJson:function(creativeData, callback){ 

    var s3 = new AWS.S3({params: {Bucket: 'bucketname'}}); 

    var params = { 
     CopySource: 'json_files/' + creativeData.user_id + '/'+creativeData.old_id + '.json', 
     Key: 'json_files/' + creativeData.user_id + '/' + creativeData.new_id + '.json', 
     ACL: 'bucket-owner-full-control' 
    }; 

    s3.copyObject(params, function(err, data) { 
     if (err) callback(err, null); 
     else  callback(null, data); 
    }); 

    } 

錯誤是：

{ 
    "message": "Access Denied", 
    "code": "AccessDenied", 
    "region": null, 
    "time": "2016-03-22T09:02:25.761Z", 
    "requestId": "45EE85638A6099DD", 
    "extendedRequestId": "ag6GzYUc5gyZ1AuNQXpcLEgMI/ry814fS5oG66JwU3+4EfEuwfmAY2vagXemAkAJWyMx9EgvQ/8=", 
    "statusCode": 403, 
    "retryable": false, 
    "retryDelay": 3.5066229524090886 
} 

有什麼我在這裏失蹤？

謝謝

Answer 1

您的IAM角色只允許訪問GetObject和ListObject。在寫入S3時，複製也需要PutObject。我認爲這應該工作：

{ 
    "Version": "2008-10-17", 
    "Id": "Policy1458587151478", 
    "Statement": [ 
     { 
      "Sid": "AllowPublicRead", 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": "*" 
      }, 
      "Action": ["s3:GetObject","s3:PutObject"], 
      "Resource": "arn:aws:s3:::bucketname/*" 
     }, 
     { 
      "Sid": "AllowPublicList", 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": "*" 
      }, 
      "Action": "s3:ListBucket", 
      "Resource": "arn:aws:s3:::bucketname" 
     } 
    ] 
}