AWS中的粒度策略文档权限

Question

我希望能够通过IAM创建的用户能够在管理控制台中查看一个特定存储桶。此外，我想给它的内斗限制到一个文件夹，这样的权限是：

我的桶/文件夹/ *

我将如何做到这一点使用的策略生成S3控制台访问？我目前有：

{ 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Action": "s3:*", 
     "Resource": "*" 
    } 
    ] 
} 

然而，当我修改资源位置 - arn:aws:s3:::my-bucket/folder - 它可以防止能够在所有使用控制台的用户。这有可能做到，我需要做些什么才能解决这个问题？

Answer 1

此政策提醒我做一个欧拉apporximation的，但是这是我做到了（带注释来解释）：

{ 
    "Statement": [ 
{    // first, allow unlimited access for S3 
    "Effect": "Allow", 
    "Action": "s3:*", 
    "Resource": "*" 
}, 
{    // second, deny access to all buckets except for the particular bucket 
    "Action": [ 
    "s3:*" 
    ], 
    "Effect": "Deny", 
    "Resource": [ 
    list-of-my-other-buckets 
    ] 
}, 
{    // third, since we've already given * permissions, the bucket has full 
       // permissions, and we need to restrcit all the permissions we don't want to give 
    "Action": [ 
    "s3:AbortMultipartUpload", 
    "s3:CreateBucket", 
    "s3:DeleteBucket", 
    "s3:DeleteObject", 
    "s3:DeleteObjectVersion", 
    "s3:GetBucketAcl", 
    "s3:GetBucketNotification", 
    "s3:GetBucketPolicy", 
    "s3:GetBucketRequestPayment", 
    "s3:GetObjectAcl", 
    "s3:GetObjectVersion", 
    "s3:GetObjectVersionAcl", 
    "s3:PutBucketAcl", 
    "s3:PutBucketNotification", 
    "s3:PutBucketPolicy", 
    "s3:PutBucketRequestPayment", 
    "s3:PutBucketVersioning", 
    "s3:PutObjectAcl", 
    "s3:PutObjectVersionAcl" 
    ],  
    "Effect": "Deny", 
    "Resource": [ 
    "arn:aws:s3:::my-bucket/*" 
      ] 
     } 
    ] 
}