本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

S3 存储 | 创建

创建用于云存储的 Amazon S3 存储桶。

完整分类：部署 | 高级堆栈组件 | S3 存储 | 创建

更改类型详情

附加信息

创建 S3 存储

S3 存储桶创建示例生成的策略

根据您创建 Amazon S3 存储桶的方式，您创建了策略。这些示例策略与中提供的各种 Amazon S3 创建场景相匹配使用 CLI 创建 S3 存储桶。

向 IAM 用户或角色授予读取权限

生成的示例策略授予 IAM 用户或角色对存储桶中对象的读取权限：

{
          "Sid": "AllowBucketReadActionsForArns",
          "Effect": "Allow",
          "Principal": {
              "AWS": [
                  "arn:aws:iam::123456789123:role/roleA”,
                  "arn:aws:iam::987654321987:role/roleB”
              ]
          },
          "Action": [
              "s3:GetBucketAcl",
              "s3:GetBucketLocation",
              "s3:ListBucket"
          ],
          "Resource": "arn:aws:s3:::ACCOUNT-ID.BUCKET_NAME"
      },
      {
          "Sid": "AllowObjectReadActionsForArns",
          "Effect": "Allow",
          "Principal": {
              "AWS": [
                  "arn:aws:iam::123456789123:role/roleA”,
                  "arn:aws:iam::987654321987:role/roleB”
              ]
          },
          "Action": [
              "s3:GetObject",
              "s3:ListMultipartUploadParts"
          ],
          "Resource": "arn:aws:s3:::ACCOUNT-ID.amzn-s3-demo-bucket/*"
}

有关使用 S3 存储桶创建此策略的执行参数创建更改类型，请参阅 使用 CLI 创建 S3 存储桶

向 IAM 用户或角色授予写入权限

以下生成的示例策略授予 IAM 用户或角色对存储桶中对象的 WRITE 访问权限。此策略不授予删除受版本控制的对象所需的权限。

{
          "Sid": "AllowObjectWriteActionsForArns",
          "Effect": "Allow",
          "Principal": {
              "AWS": [
                  "arn:aws:iam::123456789123:role/roleA”,
                  "arn:aws:iam::987654321987:role/roleB”
              ]
          },
          "Action": [
              "s3:PutObject",
              "s3:DeleteObject",
              "s3:AbortMultipartUpload"
          ],
          "Resource": "arn:aws:s3:::ACCOUNT-ID.amzn-s3-demo-bucket/*"
}

有关使用 S3 存储桶创建此策略的执行参数创建更改类型，请参阅 使用 CLI 创建 S3 存储桶

授予 AWS 服务的读取权限

生成的示例策略授予对 AWS 服务的存储桶中对象的读取权限：

{
          "Sid": "AllowBucketReadActionsForServcices",
          "Effect": "Allow",
          "Principal": {
              "Service": [
                  "rds.amazonaws.com",
                  "logs.ap-southeast-2.amazonaws.com",
                  "ec2.amazonaws.com"
              ]
          },
          "Action": [
              "s3:GetBucketAcl",
              "s3:GetBucketLocation",
              "s3:ListBucket"
          ],
          "Resource": "arn:aws:s3:::ACCOUNT-ID.amzn-s3-demo-bucket/*"
      },
      {
          "Sid": "AllowObjectReadActionsForServcices",
          "Effect": "Allow",
          "Principal": {
              "Service": [
                  "rds.amazonaws.com",
                  "logs.ap-southeast-2.amazonaws.com",
                  "ec2.amazonaws.com"
              ]
          },
          "Action": [
              "s3:GetObject",
              "s3:ListMultipartUploadParts"
          ],
          "Resource": "arn:aws:s3:::ACCOUNT-ID.amzn-s3-demo-bucket/*"
}

有关使用 S3 存储桶创建此策略的执行参数创建更改类型，请参阅 使用 CLI 创建 S3 存储桶

授予 AWS 服务的写入权限

以下生成的示例策略授予对 AWS 服务的存储桶中对象的 WRITE 访问权限。此策略不授予删除受版本控制的对象所需的权限。

{
      "Sid": "AllowObjectWriteActionsForServcices",
      "Effect": "Allow",
      "Principal": {
        "Service": [
            "rds.amazonaws.com",
            "logs.ap-southeast-2.amazonaws.com",
            "ec2.amazonaws.com"
        ]
    },
    "Action": [
          "s3:PutObject",
          "s3:DeleteObject",
          "s3:AbortMultipartUpload"
      ],
      "Resource": "arn:aws:s3:::ACCOUNT-ID.amzn-s3-demo-bucket/*"
}

有关使用 S3 存储桶创建此策略的执行参数创建更改类型，请参阅 使用 CLI 创建 S3 存储桶

用途 EnforceSecureTransport

由此产生的强制安全传输的策略示例：

{
          "Sid": "EnforceSecureTransport",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "*",
          "Resource": "arn:aws:s3:::ACCOUNT-ID.amzn-s3-demo-bucket/*",
          "Condition": {
              "Bool": {
                  "aws:SecureTransport": "false"
              }
          }
}

有关使用 S3 存储桶创建此策略的执行参数创建更改类型，请参阅 使用 CLI 创建 S3 存储桶

将访问权限限制在 IP 范围内

由此产生的策略示例限制从一组 IP 范围访问存储桶：

{
          "Sid": "RestrictBasedOnIPRanges",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "s3:*",
          "Resource": "arn:aws:s3:::ACCOUNT-ID.amzn-s3-demo-bucket/*",
          "Condition": {
              "NotIpAddress": {
                  "aws:SourceIp": [
                      “1.2.3.0/24",
                      “2.3.4.0/24"
                  ]
              }
          }
      }

有关使用 S3 存储桶创建此策略的执行参数创建更改类型，请参阅 使用 CLI 创建 S3 存储桶

执行输入参数

有关执行输入参数的详细信息，请参见变更架构类型 ct-1a68ck03fn98r。

示例：必填参数

{
  "DocumentName" : "AWSManagedServices-CreateBucket",
  "Region": "us-east-1",
  "Parameters": {
    "BucketName": "mybucket"
  }
}

示例：所有参数

{
  "DocumentName" : "AWSManagedServices-CreateBucket",
  "Region": "us-east-1",
  "Parameters": {
    "BucketName": "mybucket",
    "ServerSideEncryption": "KmsManagedKeys",
    "KMSKeyId": "arn:aws:kms:ap-southeast-2:123456789012:key/9d5948f1-2082-4c07-a183-eb829b8d81c4",
    "Versioning": "Enabled",
    "IAMPrincipalsRequiringReadObjectAccess": [
      "arn:aws:iam::123456789012:user/myuser",
      "arn:aws:iam::123456789012:role/myrole"
    ],
    "IAMPrincipalsRequiringWriteObjectAccess": [
      "arn:aws:iam::123456789012:user/myuser",
      "arn:aws:iam::123456789012:role/myrole"
    ],
    "ServicesRequiringReadObjectAccess": [
      "rds.amazonaws.com",
      "ec2.amazonaws.com",
      "logs.ap-southeast-2.amazonaws.com"
    ],
    "ServicesRequiringWriteObjectAccess": [
      "rds.amazonaws.com",
      "ec2.amazonaws.com",
      "logs.ap-southeast-2.amazonaws.com"
    ],
    "EnforceSecureTransport": true,
    "AccessAllowedIpRanges": [
      "1.0.0.0/24",
      "2.0.0.0/24"
    ],
    "Tags": [
      "{\"Key\": \"foo\", \"Value\": \"bar\"}",
      "{ \"Key\": \"testkey\",\"Value\": \"testvalue\" }"
    ]
  }
}