AWS S3 ListMultipartUploads：拒绝访问

Question

我已经关注了this blog，以便使用Web Identity Federation设置我的AWS IAM和S3帐户。我能够验证和接收会话证书和令牌都没问题。我也可以下载和上传对象。但是，我得到：

拒绝访问

以下ListMultipartUploads要求

：

var request = new ListMultipartUploadsRequest() 
{ 
    BucketName = bucketName, 
    Prefix = $"{UserId}/" 
}; 

var response = await s3Client.ListMultipartUploadsAsync(request); 

连接到我的IAM角色的接入策略为：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Effect": "Allow", 
      "Action": [ 
       "s3:AbortMultipartUpload", 
       "s3:DeleteObject", 
       "s3:GetObject", 
       "s3:PutObject" 
      ], 
      "Resource": "arn:aws:s3:::mybucket/${myidentityprovider:userId}/*" 
     }, 
     { 
      "Effect": "Allow", 
      "Action": [ 
       "s3:ListBucket", 
       "s3:ListBucketMultipartUploads" 
      ], 
      "Resource": [ 
       "arn:aws:s3:::mybucket" 
      ], 
      "Condition": { 
       "StringLike": { 
        "s3:prefix": "${myidentityprovider:userId}/" 
       } 
      } 
     } 
    ] 
} 

正如你所看到的，我有权限“s3：ListBucketMultipartUploads”，所以用户应该能够在他们的桶上执行ListMultiPartUploads。我究竟做错了什么？

Answer 1

我看到你的前缀语句中的错误，

它必须是一个数组，

“S3：前缀”： “$ {myidentityprovider：用户id}/*”]

{ 
"Version": "2012-10-17", 
"Statement": [ 
    { 
     "Effect": "Allow", 
     "Action": [ 
      "s3:AbortMultipartUpload", 
      "s3:DeleteObject", 
      "s3:GetObject", 
      "s3:PutObject" 
     ], 
     "Resource": "arn:aws:s3:::mybucket/${myidentityprovider:userId}/*" 
    }, 
    { 
     "Effect": "Allow", 
     "Action": [ 
      "s3:ListBucket", 
      "s3:ListBucketMultipartUploads" 
     ], 
     "Resource": [ 
      "arn:aws:s3:::mybucket" 
     ], 
     "Condition": { 
      "StringLike": { 
       "s3:prefix": ["${myidentityprovider:userId}/*"] 
      } 
     } 
    } 
]}