用於上傳和查看圖片的Amazon S3存儲桶政策

Question

我有一個應用程序，用戶使用facebook登錄，然後可以將圖像上傳到s3存儲區並查看它們。我使用了Cognito服務來允許每個登錄用戶上傳和查看所有文件。

我不知道如何在s3存儲桶上設置正確的權限。這是我在它的嘗試，但我得到無法保存策略，並得到Statement is missing required element - Statement "NO_ID-0" is missing "Principal" element

{ 
    "Version": "2012-10-17", 
    "Id": "Policy1457546546214", 
    "Statement": [ 
     { 
      "Sid": "Stmt1475657256771436", 
      "Effect": "Allow", 
      "Principal": "*", 
      "Action": "s3:GetObject", 
      "Resource": "arn:aws:s3:::bucket-name/*" 
     }, 
     { 
      "Sid": "Stmt16577654572138125", 
      "Effect": "Allow", 
      "Principal": "*", 
      "Action": "s3:PutObject", 
      "Resource": [ 
       "bucket-name/identity-pool-id*" 
      ] 
     } 
    ] 
} 

這是客戶端部分，如果它可以幫助：

FB.login(function (response) { 
    if (response.authResponse) { 

     AWS.config.region = 'eu-west-1'; 
     AWS.config.credentials = new AWS.CognitoIdentityCredentials({ 
     IdentityPoolId: 'eu-west-1:xxxxxxxxxxx', 
     Logins: { 
      'graph.facebook.com': response.authResponse.accessToken 
     } 
     }) 

     var bucket = new AWS.S3({params: {Bucket: 'name'}}) 
     var fileChooser = document.getElementById('file-chooser') 
     var button = document.getElementById('upload-button') 

     button.addEventListener('click', function() { 
     var file = fileChooser.files[0] 
     var params = {Key: file.name, ContentType: file.type, Body: file} 
     bucket.upload(params, function (err, data) { 
     ... 

Cognito IAM > Roles > Cognito_myappAuth_Role：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Action": [ 
       "cognito-identity:*" 
      ], 
      "Effect": "Allow", 
      "Resource": [ 
       "*" 
      ] 
     }, 
     { 
      "Effect": "Allow", 
      "Action": [ 
       "s3:GetObject", 
       "s3:PutObject", 
       "s3:PutObjectAcl" 
      ], 
      "Resource": [ 
       "arn:aws:s3:::bucket/${cognito-identity.amazonaws.com:sub}/*", 
       "arn:aws:s3:::bucket/${cognito-identity.amazonaws.com:sub}" 
      ] 
     } 
    ] 
} 

Answer 1

你簽出了this blog post？它有一個很好的例子，說明如何設置允許用戶訪問S3存儲桶的角色。切割出名單鬥一部分出來，你會鏈接到你的身份池角色的訪問策略可能是這個樣子：

 
{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Action": [ 
     "s3:GetObject", 
     "s3:PutObject" 
     ], 
     "Effect": "Allow", 
     "Resource": ["arn:aws:s3:::mybucket/${cognito-identity.amazonaws.com:sub}/*"] 
    } 
    ] 
} 

編輯：;：

鉈從未來的讀者評論博士

- 將策略應用到池的認證角色而不是存儲桶

- 如果應用用例需要公共區域，請使用存儲桶根目錄，否則使用策略中定義的每個標識的目錄（如博客）

- 角色本身不適用，直到認證發生之後。該政策只是規定了回饋的證書將有權獲得什麼和做什麼。