Can we allow getObject with bucket policy using "Effect": "Deny" and condition

0

My policy role is below JSON format code

{ "Version": "2008-10-17", "Statement": [ { "Sid": "AllowPublicRead", "Effect": "Deny", "Principal": { "AWS": "" }, "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::ABC_123", "arn:aws:s3:::ABC_123/" ], "Condition": { "StringNotLike": { "aws:Referer": [ "http://www.training.sedarspine.com/", "http://training.sedarspine.com/", "https://www.training.sedarspine.com/", "https://training.sedarspine.com/", "https://sedarspine.com/", "https://www.sedarspine.com/", "https://burtlan.sedarspine.com/", "https://www.burtlan.sedarspine.com/", "https://sedarglobal.com/", "https://www.sedarglobal.com/", "https://live.sedarglobal.com/", "https://www.live.sedarglobal.com/", "http://live.sedarglobal.com/", "http://www.live.sedarglobal.com/", "https://test.sedarglobal.com/", "https://www.test.sedarglobal.com/", "http://localspine.com/", "https://localspine.com/", "http://www.localspine.com/", "https://login.burtlan.com/", "https://sc.sedarglobal.com/", "http://sc.sedarglobal.com/", "https://spinebusiness.com/", "http://spinebusiness.com/", "http://localburtlan.com/", "http://pre.sedarglobal.com/", "https://pre.sedarglobal.com/", "https://localspine.test/", "http://132.1.0.105:3000/", "http://dxb.sedarspine.com/", "https://dxb.sedarspine.com/", "https://sedaruae.homeip.net/", "http://localhost:3000/" ] } } }, { "Sid": "AllowPublicRead-1", "Effect": "Allow", "Principal": "", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::ABC_123", "arn:aws:s3:::ABC_123/*" ] } ] }

已提問 2 年前檢視次數 281 次
1 個回答
1

The question could use some clarification with the description given. However, the policy posted policy will "DENY" a "blank" Principal to preform the "Action" ("s3:GetObject","s3:PutObject","s3:ListBucket") if the referrer is not apart of the list. When the principal becomes specified it should be okay for IAM purposes, especially if it goes from "blank" to "*".

referrer documentation

AWS
JClapp
已回答 10 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南