Oor*_*ort 5 post amazon-s3 amazon-web-services
我已经成功创建了一个简单的HTML表单，该表单将上传的文件发布到我的Amazon S3存储桶中。我遵循了以下指示信息：http :
//aws.amazon.com/articles/1434
现在，我试图在可以执行HTML表单POST的用户上创建最小策略。
设置如下：
userID: s3-uploader<br/>
ACCESS-KEY-ID: AXAXAXAXAXAXAXAXAXAX
这是HTML表单：
userID: s3-uploader<br/>
ACCESS-KEY-ID: AXAXAXAXAXAXAXAXAXAX
...然后我得到的是表单隐藏输入“ policy”的未编码版本：
<!DOCTYPE html>
<html>
<head>
<title>S3 POST Form</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
</head>
<body>
<form action="https://<cname-for-upload-bucket>/" method="post" enctype="multipart/form-data">
<input type="hidden" name="key" value="foo/${filename}">
<input type="hidden" name="AWSAccessKeyId" value="AXAXAXAXAXAXAXAXAXAX">
<input type="hidden" name="acl" value="private">
<input type="hidden" name="success_action_redirect"
value="https://s3.amazonaws.com/<bucket-01-name>/upload-success.html">
<input type="hidden" name="policy"
value="eyJleHBpcmF0aW9uIjogIjIwMTQtMTItMTNUMDA6MDA6MDBaIiwKICAgICJjb25kaXRpb25zIjogWwogICAgICAgIHsiYnVja2V0IjogInMzLXVwLmdyaWR3YXJkLm5ldCJ9LAogICAgICAgIFsic3RhcnRzLXdpdGgiLCAiJGtleSIsICJwZWQvIl0sCiAgICAgICAgeyJhY2wiOiAicHJpdmF0ZSJ9LAogICAgICAgIHsic3VjY2Vzc19hY3Rpb25fcmVkaXJlY3QiOiAiaHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL2dkd2QvdXBsb2FkLXN1Y2Nlc3MuaHRtbCJ9LAogICAgICAgIFsic3RhcnRzLXdpdGgiLCAiJENvbnRlbnQtVHlwZSIsICIiXSwKICAgICAgICBbImNvbnRlbnQtbGVuZ3RoLXJhbmdlIiwgMCwgMTA0ODU3Nl0KICAgIF0KfQ==">
<input type="hidden" name="signature" value="WnbMCo0OY7g8oYkfxrVb8np4l94=">
<input type="hidden" name="Content-Type" value="image/jpeg">
<!-- Include any additional input fields here -->
File to upload to S3:
<input name="file" type="file">
<br>
<input type="submit" value="Upload File to S3">
</form>
</body>
</html>
当userId：s3-uploader的策略为：
{"expiration": "2014-12-13T00:00:00Z",
"conditions": [
{"bucket": "<cname-for-upload-bucket>"},
["starts-with", "$key", "foo/"],
{"acl": "private"},
{"success_action_redirect": "https://s3.amazonaws.com/<bucket-01-name>/upload-success.html"},
["starts-with", "$Content-Type", ""],
["content-length-range", 0, 1048576]
]
}
...但是如果我将策略更改为更明确的内容，但看起来仍然合理，我会从完全相同的HTML表单帖子中收到<AccessDenied />消息。
这是我尝试的更具限制性的政策：
{
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "*"
}
]
}
我在这里阅读了文档，但并没有获得更多的清晰度：
http : //docs.aws.amazon.com/AmazonS3/latest/dev/UsingIAMPolicies.html
所以我问我的Overflow伙伴，我缺少什么？我真的希望s3-uploader userId不能对存储桶执行任何操作（即“ s3：*”）。
| 归档时间： |
|
| 查看次数： |
4399 次 |
| 最近记录： |