我正在与我的IT团队一起限制我的用户帐户(在root帐户下),以便它无法访问我不想访问的S3存储桶。启用AWSLambdaFullAccess策略时,可以完全访问许多AWS功能,包括全部S3功能。以下是AWSLambdaFullAccess策略:AWS IAM策略:如何更改AWSLambdaFullAccess策略以仅允许访问一个S3存储桶?
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudwatch:*",
"cognito-identity:ListIdentityPools",
"cognito-sync:GetCognitoEvents",
"cognito-sync:SetCognitoEvents",
"dynamodb:*",
"events:*",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:PassRole",
"kinesis:DescribeStream",
"kinesis:ListStreams",
"kinesis:PutRecord",
"lambda:*",
"logs:*",
"s3:*",
"sns:ListSubscriptions",
"sns:ListSubscriptionsByTopic",
"sns:ListTopics",
"sns:Subscribe",
"sns:Unsubscribe"
],
"Resource": "*"
}
]
}
大部分情况都没有问题。我如何将其作为新策略进行修改,以便我只能访问“arn:aws:s3 ::: lambda-scripts”存储桶?
我会去解决这个问题。的确,AWSLambdaFullAccess策略提供了比我需要的更多的访问。我会制定一个新的政策,减少所有的脂肪。 –