如何在AWS策略中提供多个StringNotEquals条件？

Question

我正在尝试编写AWS S3存储桶策略,拒绝所有流量,除非它来自两个VPC.我正在尝试编写的策略类似于下面的策略,两者之间具有逻辑AND StringNotEquals(除了它是无效的策略):

{
   "Version": "2012-10-17",
   "Id": "Policy1415115909152",
   "Statement": [
     {
       "Sid": "Allow-access-only-from-two-VPCs",
       "Action": "s3:*",
       "Effect": "Deny",
       "Resource": ["arn:aws:s3:::my-bucket",
                    "arn:aws:s3:::my-bucket/*"],
       "Condition": {
         "StringNotEquals": {
           "aws:sourceVpc": "vpc-111bbccc"
         },
         "StringNotEquals": {
           "aws:sourceVpc": "vpc-111bbddd"
         }
       },
       "Principal": "*"
     }
   ]
}

如果我用这个:

"StringNotEquals": {
       "aws:sourceVpc": ["vpc-111bbccc", "vpc-111bbddd"]
     }

然后至少有一个字符串比较返回true,并且无法从任何地方访问S3存储桶.

Answer 1

以前从未尝试过此方法，但是以下方法应该可行。来自：使用IAM策略条件进行细粒度的访问控制

    "Condition": {
        "ForAllValues:StringNotEquals": {
            "aws:sourceVpc": [
                "vpc-111bbccc",
                "vpc-111bbddd"
            ]
        },

Answer 2

原始 JSON 的问题：

"Condition": {
    "StringNotEquals": {
        "aws:sourceVpc": "vpc-111bbccc"
    },
    "StringNotEquals": {
        "aws:sourceVpc": "vpc-111bbddd"
    }
}

您不能有名为 的重复键StringNotEquals。

但是有几种方法可以解决您的问题。

翻转条件并指定Allow而不是Deny权限

不言自明：使用Allow权限而不是Deny然后StringEquals与数组一起使用。所有值都将作为OR条件。

{
   "Version": "2012-10-17",
   "Id": "Policy1415115909152",
   "Statement": [
     {
       "Sid": "Allow-access-only-from-two-VPCs",
       "Action": "s3:*",
       "Effect": "Allow",
       "Resource": ["arn:aws:s3:::my-bucket",
                    "arn:aws:s3:::my-bucket/*"],
       "Condition": {
         "StringEquals": {
           "aws:sourceVpc": ["vpc-111bbccc", "vpc-111bbddd"]
         }
       },
       "Principal": "*"
     }
   ]
}

使用集合运算符

IAM 策略允许使用ForAnyValues和ForAllValues，这使您可以测试Condition.

{
   "Version": "2012-10-17",
   "Id": "Policy1415115909152",
   "Statement": [
     {
       "Sid": "Deny-access-except-from-two-VPCs",
       "Action": "s3:*",
       "Effect": "Deny",
       "Resource": ["arn:aws:s3:::my-bucket",
                    "arn:aws:s3:::my-bucket/*"],
       "Condition": {
         "ForAllValues:StringNotEquals": {
           "aws:sourceVpc": ["vpc-111bbccc", "vpc-111bbddd"]
         }
       },
       "Principal": "*"
     }
   ]
}

使用的黑客组合StringNotEquals和StringNotEqualsIgnoreCase

我相当肯定这是有效的，但它只会将您的条件限制为 2 个 VPC。

{
   "Version": "2012-10-17",
   "Id": "Policy1415115909152",
   "Statement": [
     {
       "Sid": "Deny-access-except-from-two-VPCs",
       "Action": "s3:*",
       "Effect": "Deny",
       "Resource": ["arn:aws:s3:::my-bucket",
                    "arn:aws:s3:::my-bucket/*"],
       "Condition": {
         "StringNotEquals": {
           "aws:sourceVpc": ["vpc-111bbccc"]
         },
         "StringNotEqualsIgnoreCase": {
           "aws:sourceVpc": ["vpc-111ddeee"]
         }
       },
       "Principal": "*"
     }
   ]
}