Syntax of a s3 bucket policy to wildcard SourceArn condition

0

This is the format of a bucket policy generated with a CloudFront using origin access:

        {
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::something-s3bucketroot-something/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::0123456789:distribution/ABCDEFGHI"
                }
            }
        }

Is there a way to wildcard the SourceArn to allow for any distributions from the account? I tried "StringLike" and left off the distribution ID but that didn't seem to work. Alternatively, if that's not possible, is there a way to use an OR condition on multiple values on the conditional?

已提問 5 個月前檢視次數 249 次
1 個回答
1
已接受的答案

Yes this works. You need to use splat (wildcard)

"AWS:SourceArn": "arn:aws:cloudfront::0123456789:distribution/*"

profile picture
專家
已回答 5 個月前
  • Works! But you need StringLike instead of StringEquals...thought I'd tried that...

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南