小编Sar*_*s P的帖子

我有一个运行服务器的Amazon EC2实例,需要为其客户端(Windows 7/8,iPad等)提供对S3资源的联合访问.到目前为止,我创建了以下内容:

• 一种IAM角色,用于限制服务器对S3资源和其他Amazon Web服务的访问.
• 能够使用STS服务的IAM用户,即GetFederationToken.

通常,客户端将请求访问以获取或将对象放入S3,从不删除.因此,在放置文件的情况下,不是让客户端将文件上传到服务器然后从服务器将其转发到S3,我想为客户端提供临时访问凭证,以便将文件直接放入适当的S3存储桶中.

以下是EC2实例IAM角色的样子:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": "arn:aws:s3:::devtestbucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [ "sqs:*" ],
      "Resource": "arn:aws:sqs:us-west-2::dev-*"      
    },
    {
      "Effect": "Allow",
      "Action": [ "dynamodb:*" ],
      "Resource": "arn:aws:dynamodb:us-west-2::dev-*"      
    },
    {
      "Effect": "Allow",
      "Action": [ "sts:*" ],
      "Resource": "*"      
    }
  ]
}

STS Token Issuer IAM用户策略是:

{
  "Statement": [
    {
      "Action": [
        "sts:GetFederationToken"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:sts:::federated-user/*"
      ]
    },
    {
      "Action": [
        "s3:*"
      ],
      "Effect": …