相关疑难解决方法(0)

我有以下政策:

{
        "Version": "2008-10-17",
        "Id": "PolicyForCloudFrontPrivateContent",
        "Statement": [
            {
                "Sid": "Stmt1395852960432",
                "Action": "s3:*",
                "Effect": "Deny",
                "Resource": "arn:aws:s3:::my-bucket/*",
                "Principal": {
                    "AWS": [
                        "*"
                    ]
                }
            },
            {
                "Sid": "1",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1IYJC432545JN"
                },
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::my-bucket/*"
            }
        ]
    }

但是,这会拒绝来自所有请求者的请求,甚至是Cloudfront.这样做的正确方法是什么？

问题是客户端使用公共读取创建对象.我目前没有立即控制客户端来更改此设置.所以我想要的是拥有一个覆盖单个对象ACL的策略.所以默认否认这里不起作用.