21 changes: 21 additions & 0 deletions 21 terraform/s3.tf Original file line numberDiff line numberDiff line change @@ -13,3 +13,24 @@ resource "aws_s3_bucket_ownership_controls" "blog_zola_bucket_oc" { object_ownership = "BucketOwnerEnforced" } } resource "aws_s3_bucket_policy" "...
SampleBucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref DOC-EXAMPLE-BUCKET PolicyDocument: Version: 2012-10-17 Statement: - Action: - 's3:GetObject' Effect: Allow Resource: !Join - '' - - 'arn:aws:s3:::' - !Ref DOC-EXAMPLE-BUCKET - /* Principal: '*' Condition:...
Checks that the access granted by the Amazon S3 bucket is restricted to any of the AWS principals, federated users, service principals, IP addresses, or VPCs that you provide. The rule is COMPLIANT if a bucket policy is not present.
在防盗链设计上,我们可以在 awsdemo2018 存储桶中设置存储桶策略,只允许源站为https://s3.cn-north-1.amazonaws.com.cn/的请求访问这张图片,如果请求中不带这个 referer 就提示报错。具体操作如下: 在awsdemo2018 存储桶策略中,加上 condition,设置 StringLike 为 aws:Referer,后面跟 上源站地址,示例策略如下...
"AWS":"arn:aws-cn:iam::Account-ID:user/Dave" }, "Action":[ "s3:GetObject", "s3:GetBucketLocation", "s3:ListBucket" ], "Resource":[ "arn:aws-cn:s3:::examplebucket/*", "arn:aws-cn:s3:::examplebucket" ] } ] } 1.
首先在IAM里面创建一个 Group,我给这个Group attach一个AWS Managed的 Policy,这个自带的policy允许S3 的只读权限 测试一下,发现只能浏览,但是不能上传 接下来,自己自定义一个Policy,自定义这个Policy允许用户上传文件 把这两个Policy都attach到我们的Group上,这个Group里面的User就可以浏览所有的Bucket,也可以上传文件...
在对应的bucket里面, 进入Permission - Bucket Policy - 最下面选择 Policy Generator 基本设置 Type of Policy:S3 Bucket Policy Effect:Deny Principal: AWS Service: Amazon S3 Actions: PutObject ARN: arn:aws:s3:::XXXXXX Condition:stringnotequals ...
aws_s3_bucket_policyを設定 Premium Support Enterprise-grade 24/7 support Triggered via push May 29, 2024 14:36 gyvm pushed 3e8dbf8 main StatusFailure Total duration16s Artifacts–
这是一个正在工作的CDK-Stack的示例：
Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured two-way replication between the S3 ...