AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관
AWS re:Postre:Post

Use boto3 to create buckets with ACLs enabled

0

Hello. I’m creating a bucket using boto3 with:

s3X = boto3.resource('s3')
s3X.create_bucket(Bucket=’my_bucket_name’)

This creates the bucket but it blocks all public access (and sets ACLs as disabled). I tried modifying the last line as:

s3X.create_bucket(Bucket=’my_bucket_name’, ACL=’public-read-write’)

However, this generates the error message:

botocore.exceptions.ClientError: An error occurred (InvalidBucketAclWithObjectOwnership) when calling the CreateBucket operation: Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting

The instance has the AWS credentials and I was expecting to be able to set up the bucket properties via boto3.

주제
스토리지관리 및 거버넌스
태그
아마존 심플 스토리지 서비스AWS 명령줄 인터페이스스토리지
언어
English
AWS-User-7310704
질문됨 일 년 전1089회 조회
2개 답변
1
수락된 답변

Sorry, I just checked the documentation and it looks like the default setting is to deny public access.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

By default, new buckets, access points, and objects don't allow public access.

In other words, after the bucket is created, the public access settings need to be disabled and the ACLs set, so the code should look like the following.

s3X.create_bucket(Bucket=’my_bucket_name’,ObjectOwnership='ObjectWriter')
s3X.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration={'BlockPublicAcls': False,'IgnorePublicAcls': False,'BlockPublicPolicy': False,'RestrictPublicBuckets': False})
s3X.put_bucket_acl(ACL='public-read-write',Bucket=’my_bucket_name’)
profile picture
전문가
Riku_Kobayashi
답변함 일 년 전
  • Riku_Kobayashi 전문가
    일 년 전

    Your code is trying to create an S3 bucket with "resource". As per the following documentation, "client" is used to create S3 buckets. https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3.html#client

    So the full code is as follows.

    import boto3

s3X = boto3.client('s3')
s3X.create_bucket(Bucket=’my_bucket_name’,ObjectOwnership='ObjectWriter')
s3X.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration={'BlockPublicAcls': False,'IgnorePublicAcls': False,'BlockPublicPolicy': False,'RestrictPublicBuckets': False})
s3X.put_bucket_acl(ACL='public-read-write',Bucket=’my_bucket_name’)
  • Riku_Kobayashi 전문가
    일 년 전

    Since "resource" does not seem to have "put_public_access_block", I created a code to use "client" as well.

    import boto3

s3X = boto3.resource('s3')
s3X.create_bucket(Bucket='my-bucket-name',ObjectOwnership='ObjectWriter',CreateBucketConfiguration={'LocationConstraint': 'ap-northeast-1'})

client = boto3.client('s3')
client.put_public_access_block(Bucket='my-bucket-name', PublicAccessBlockConfiguration={'BlockPublicAcls': False,'IgnorePublicAcls': False,'BlockPublicPolicy': False,'RestrictPublicBuckets': False})
client.put_bucket_acl(ACL='public-read-write',Bucket='my-bucket-name')
  • AWS-User-7310704
    일 년 전

    @Riku_Kobayashi: Using 'resource' is preferable when integrated into python projects (which is the case), but if resource doesn't have the put_public_access_method (and probably others), I guess that you can use 'client' or a combination of 'client' and 'resource.' Thanks.

0

Try changing the code as follows.
The error occurs when ObjectOwnership is "BucketOwnerEnforced".

s3X.create_bucket(Bucket=’my_bucket_name’, ACL=’public-read-write’, ObjectOwnership='ObjectWriter')

BucketOwnerEnforced" is changed to "ObjectWriter" because ACLs are disabled and an error occurs when ACL settings are inserted.

profile picture
전문가
Riku_Kobayashi
답변함 일 년 전
  • AWS-User-7310704
    일 년 전

    Still generating an error message: 'botocore.exceptions.ClientError: An error occurred (InvalidBucketAclWithBlockPublicAccessError) when calling the CreateBucket operation: Bucket cannot have public ACLs set with BlockPublicAccess enabled'

  • Riku_Kobayashi 전문가
    일 년 전

    Sorry, I just checked the documentation and it looks like the default setting is to deny public access. https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

    By default, new buckets, access points, and objects don't allow public access.

    In other words, after the bucket is created, the public access settings need to be disabled and the ACLs set, so the code should look like the following.

    s3X.create_bucket(Bucket=’my_bucket_name’,ObjectOwnership='ObjectWriter')
s3X.put_public_access_block(Bucket=bucket_name, PublicAccessBlockConfiguration={'BlockPublicAcls': False,'IgnorePublicAcls': False,'BlockPublicPolicy': False,'RestrictPublicBuckets': False})
s3X.put_bucket_acl(ACL='public-read-write',Bucket=’my_bucket_name’)

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠