用于上传和查看图片的Amazon S3存储桶政策

Question

我有一个应用程序，用户使用facebook登录，然后可以将图像上传到s3存储区并查看它们。我使用了Cognito服务来允许每个登录用户上传和查看所有文件。

我不知道如何在s3存储桶上设置正确的权限。这是我在它的尝试，但我得到无法保存策略，并得到Statement is missing required element - Statement "NO_ID-0" is missing "Principal" element

{ 
    "Version": "2012-10-17", 
    "Id": "Policy1457546546214", 
    "Statement": [ 
     { 
      "Sid": "Stmt1475657256771436", 
      "Effect": "Allow", 
      "Principal": "*", 
      "Action": "s3:GetObject", 
      "Resource": "arn:aws:s3:::bucket-name/*" 
     }, 
     { 
      "Sid": "Stmt16577654572138125", 
      "Effect": "Allow", 
      "Principal": "*", 
      "Action": "s3:PutObject", 
      "Resource": [ 
       "bucket-name/identity-pool-id*" 
      ] 
     } 
    ] 
} 

这是客户端部分，如果它可以帮助：

FB.login(function (response) { 
    if (response.authResponse) { 

     AWS.config.region = 'eu-west-1'; 
     AWS.config.credentials = new AWS.CognitoIdentityCredentials({ 
     IdentityPoolId: 'eu-west-1:xxxxxxxxxxx', 
     Logins: { 
      'graph.facebook.com': response.authResponse.accessToken 
     } 
     }) 

     var bucket = new AWS.S3({params: {Bucket: 'name'}}) 
     var fileChooser = document.getElementById('file-chooser') 
     var button = document.getElementById('upload-button') 

     button.addEventListener('click', function() { 
     var file = fileChooser.files[0] 
     var params = {Key: file.name, ContentType: file.type, Body: file} 
     bucket.upload(params, function (err, data) { 
     ... 

Cognito IAM > Roles > Cognito_myappAuth_Role：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Action": [ 
       "cognito-identity:*" 
      ], 
      "Effect": "Allow", 
      "Resource": [ 
       "*" 
      ] 
     }, 
     { 
      "Effect": "Allow", 
      "Action": [ 
       "s3:GetObject", 
       "s3:PutObject", 
       "s3:PutObjectAcl" 
      ], 
      "Resource": [ 
       "arn:aws:s3:::bucket/${cognito-identity.amazonaws.com:sub}/*", 
       "arn:aws:s3:::bucket/${cognito-identity.amazonaws.com:sub}" 
      ] 
     } 
    ] 
} 

Answer 1

你签出了this blog post？它有一个很好的例子，说明如何设置允许用户访问S3存储桶的角色。切割出名单斗一部分出来，你会链接到你的身份池角色的访问策略可能是这个样子：

 
{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Action": [ 
     "s3:GetObject", 
     "s3:PutObject" 
     ], 
     "Effect": "Allow", 
     "Resource": ["arn:aws:s3:::mybucket/${cognito-identity.amazonaws.com:sub}/*"] 
    } 
    ] 
} 

编辑：;：

铊从未来的读者评论博士

- 将策略应用到池的认证角色而不是存储桶

- 如果应用用例需要公共区域，请使用存储桶根目录，否则使用策略中定义的每个标识的目录（如博客）

- 角色本身不适用，直到认证发生之后。该政策只是规定了回馈的证书将有权获得什么和做什么。