S3 存储桶策略

最新推荐文章于 2025-07-10 00:27:54 发布

原创最新推荐文章于 2025-07-10 00:27:54 发布 · 533 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#ceph

本文展示了如何配置AWSS3存储桶的访问策略，包括向所有人授予公共读取权限，限制特定IP地址的完全访问，防止热链接以及设定只允许特定IP写入而公开读取的规则。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

通用策略

向匿名用户（即所有人）授予公共读取权限

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowPublicRead",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::my-brand-new-bucket/*"
      ]
    }
  ]
}

从特定 IP 地址为用户授予完全访问权限。

{
  "Version": "2008-10-17",
  "Id": "S3PolicyId1",
  "Statement": [
    {
      "Sid": "IPAllow",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-brand-new-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.168.143.0/24"
        },
        "NotIpAddress": {
          "aws:SourceIp": "192.168.143.188/32"
        }
      }
    },
    {
      "Sid": "IPDeny",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-brand-new-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.1.2.0/24"
        }
      }
    }
  ]
}

保护 s3 文件免受热链接的影响。

{
  "Version": "2008-10-17",
  "Id": "preventHotLinking",
  "Statement": [
    {
      "Sid": "1",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-brand-new-bucket/*",
      "Condition": {
        "StringLike": {
          "aws:Referer": [
            "http://yourwebsitename.com/*",
            "http://www.yourwebsitename.com/*"
          ]
        }
      }
    }
  ]
}

仅允许特定 IP 写入存储桶，并且每个人都从中读取。

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-brand-new-bucket/*",
      "Condition": {
        
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::my-brand-new-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.168.0.0/16"
        }
      }
    }
  ]
}