AWS S3 403 Forbidden Error on new created IAM inline policy for a new IAM user

Posted 2023-02-23

【中文标题】AWS S3 403 Forbidden Error on new created IAM inline policy for a new IAM user

【英文标题】：AWS S3 403 Forbidden Error on newly created IAM inline policy for a new IAM user

【发布时间】：2016-06-26 05:43:11

【问题描述】：

我有一个全新的 IAM 用户，我想授予对我新创建的存储桶的上传和读取权限 - myapp。

这是我现在为我的用户使用的策略：

    "Version": "2012-10-17",
    "Statement": [
        
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        ,
        
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::myapp"
            ]
        ,
        
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::myapp/*"
            ]
        
    ]

使用此策略，我可以登录控制台、创建文件夹并将图像上传到这些文件夹。

但是，当我尝试通过我的应用上传图片时，我得到的是：

Excon::Errors::Forbidden at /jobs
Expected(200) <=> Actual(403 Forbidden)
excon.error.response
  :body          => "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>0FF1D4848595DCFB</RequestId><HostId>+RrQvNFwV2hAcYPK3ZJJYzy5uiA7Aag0oc1Gpp3hENJ9lzJz453j8qJeLbdQ8jN4cc3ViRJ1lEg=</HostId></Error>"
  :cookies       => [
  ]
  :headers       => 
    "Connection"       => "close"
    "Content-Type"     => "application/xml"
    "Date"             => "Sat, 25 Jun 2016 18:54:24 GMT"
    "Server"           => "AmazonS3"
    "x-amz-id-2"       => "+R3ViRJ1lEg="
    "x-amz-request-id" => "0FF1DCFB"
  
  :host          => "s3.amazonaws.com"
  :local_address => "192.168.1.102"
  :local_port    => 23456
  :path          => "/logos/company/logo/48/amped-logo.png"
  :port          => 443
  :reason_phrase => "Forbidden"
  :remote_ip     => "xx.xx.xxx.xxx"
  :status        => 403
  :status_line   => "HTTP/1.1 403 Forbidden\r\n"

这是我的 CORS 规则：

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <CORSRule>
        <AllowedOrigin>http://localhost:3000</AllowedOrigin>
        <AllowedMethod>HEAD</AllowedMethod>
        <AllowedMethod>GET</AllowedMethod>
        <AllowedMethod>PUT</AllowedMethod>
        <AllowedMethod>POST</AllowedMethod>
        <AllowedMethod>DELETE</AllowedMethod>
        <ExposeHeader>ETag</ExposeHeader>
        <AllowedHeader>*</AllowedHeader>
    </CORSRule>
</CORSConfiguration>

这是我的config/initializers/carrierwave.rb 文件：

CarrierWave.configure do |config|
  config.fog_credentials = 
    provider:               'AWS',
    aws_access_key_id:      ENV["MYAPP_S3_KEY"],
    aws_secret_access_key: ENV["MYAPP_SECRET_KEY"]
  
  config.fog_directory  = ENV["MYBUCKET"]
end

这可能是什么原因造成的，我该如何解决？

【参考方案1】：

其实我只是想通了，这是一件小事。

我所要做的就是将"s3:PutObjectAcl" 添加到我的策略中。

所以现在，我的政策如下所示：

    "Version": "2012-10-17",
    "Statement": [
        
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        ,
        
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::myapp"
            ]
        ,
        
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::myapp/*"
            ]
        
    ]

现在可以了。

我从this answer 那里得到了小​​费，它救了我的培根。