\u53c2\u8003\uff1ahttps:\/\/docs.aws.amazon.com\/transfer\/latest\/userguide\/users.html<\/a> \u9488\u5bf9 <\/p>\n Following, you can see how to create an IAM policy that allows read and write access to a specific Amazon S3 bucket. Assigning an IAM role that has this IAM policy to your user gives that user read\/write access to the specified Amazon S3 bucket.<\/p>\n The following policy provides programmatic read and write access to an Amazon S3 bucket.<\/p>\n The If your bucket is enabled for AWS Key Management Service (AWS KMS) encryption, you need to enable additional actions in the policy. For more information about AWS KMS, see What is AWS Key Management Service?<\/a><\/p>\n To further scope down your users’ access to only the home directory of the specified Amazon S3 bucket, see Create a scope-down policy<\/a>.<\/p>\n A You can use a To create a Note: You can’t use the variables listed preceding as policy variables in an IAM role definition. You create these variables in an IAM policy and supply them directly when setting up your user. Also, you can’t use the ${aws:Username}variable in this scope-down policy. This variable refers to an IAM user name and not the user name required by AWS Transfer Family.<\/p>\n<\/blockquote>\n An example of a scope-down policy is shown in the code example following.<\/p>\n With the preceding policy in place, when a user logs in, they can access only objects in their home directory. At connection time, AWS Transfer Family replaces these variables with the appropriate values for the user. Doing this makes it easier to apply the same policy documents to multiple users. This approach reduces the overhead of IAM role and policy management for managing your users’ access to your Amazon S3 bucket.<\/p>\n You can also use a scope-down policy to customize access for each of your users based on your business requirements. For more information, see Permissions for AssumeRole, AssumeRoleWithSAML, and AssumeRoleWithWebIdentity<\/a> in the IAM User Guide.<\/p>\n Note: AWS Transfer Family stores the policy JSON, instead of the Amazon Resource Name (ARN) of the policy. So when you change the policy in the IAM console, you need to return to AWS Transfer Family console and update your users with the latest policy contents. You can update the user under You can prevent users from creating a directory in an Amazon S3 bucket. To do so, you create an IAM policy that allows the The following example policy allows users to upload files to an Amazon S3 bucket but doesn\u2019t allow them to create a directory in the bucket. That is, it denies the mkdir command in the Amazon S3 bucket.<\/p>\n \u9488\u5bf9 \uff081\uff09Create role<\/p>\n \uff082\uff09\u9009\u62e9Transfer\u670d\u52a1<\/p>\n \uff083\uff09Create policy<\/p>\n \u53c2\u8003\u914d\u7f6e\uff1a<\/p>\n
\n\u53c2\u8003\uff1ahttps:\/\/docs.aws.amazon.com\/transfer\/latest\/userguide\/users-policies.html<\/a><\/p>\n\n
Service managed<\/code>(Create and manage users within the service)\u65b9\u5f0f<\/p>\n<\/blockquote>\nAllowing read and write access to an Amazon S3 bucket<\/h3>\n
{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Effect": "Allow",\n "Action": [\n "s3:ListBucket",\n "s3:GetBucketLocation"\n ],\n "Resource": ["arn:aws:s3:::bucketname"]\n },\n {\n "Effect": "Allow",\n "Action": [\n "s3:PutObject",\n "s3:GetObject",\n "s3:DeleteObject", \n "s3:DeleteObjectVersion",\n "s3:GetObjectVersion",\n "s3:GetObjectACL",\n "s3:PutObjectACL"\n ],\n "Resource": ["arn:aws:s3:::bucketname\/*"]\n }\n ]\n}<\/code><\/pre>\nListBucket<\/code> action requires permission to the bucket itself. The PUT<\/code>, GET<\/code>, and DELETE<\/code> actions require object permissions. Because these are different entities, they are specified using different Amazon Resource Names (ARNs).<\/p>\nCreate a scope-down policy<\/h3>\n
scope-down policy<\/code> is an AWS Identity and Access Management (IAM) policy that restricts users to certain portions of an Amazon S3 bucket. It does so by evaluating access in real time.<\/p>\nscope-down policy<\/code> when you need to give the same access to a group of users to a particular portion of your Amazon S3 bucket. For example, a group of users might need access to only the home<\/code> directory. That group of users share the same IAM role.<\/p>\nscope-down policy<\/code>, use the following policy variables in your IAM policy:<\/p>\n\n
${transfer:HomeBucket}<\/code><\/li>\n${transfer:HomeDirectory}<\/code><\/li>\n${transfer:HomeFolder}<\/code><\/li>\n${transfer:UserName}<\/code><\/li>\n<\/ul>\n\n
{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Sid": "AllowListingOfUserFolder",\n "Action": [\n "s3:ListBucket"\n ],\n "Effect": "Allow",\n "Resource": [\n "arn:aws:s3:::${transfer:HomeBucket}"\n ],\n "Condition": {\n "StringLike": {\n "s3:prefix": [\n "${transfer:HomeFolder}\/*",\n "${transfer:HomeFolder}"\n ]\n }\n }\n },\n {\n "Sid": "HomeDirObjectAccess",\n "Effect": "Allow",\n "Action": [\n "s3:PutObject",\n "s3:GetObject",\n "s3:DeleteObjectVersion",\n "s3:DeleteObject",\n "s3:GetObjectVersion",\n "s3:GetObjectACL",\n "s3:PutObjectACL"\n ],\n "Resource": "arn:aws:s3:::${transfer:HomeDirectory}*"\n }\n ]\n}<\/code><\/pre>\n\n
Policy Info<\/code> tab in the User configuration<\/code> section. For more information, see Editing the user configuration<\/a>.<\/p>\n<\/blockquote>\nPreventing users from creating a directory in an S3 bucket<\/h3>\n
s3:PutObject<\/code> action but also denies it when the key ends with a "\/"<\/code> (forward slash).<\/p>\n{\n "Sid":"DenyMkdir",\n "Action":[\n "s3:PutObject"\n ],\n "Effect":"Deny",\n "Resource":"arn:aws:s3:::my-sftp-bucket\/*\/"\n}<\/code><\/pre>\nAPI Gateway Lambda Functions IAM\u89d2\u8272\u5b9e\u8df5<\/h2>\n
\n
Custom<\/code>(Provide an Amazon API Gateway URL)\u65b9\u5f0f<\/p>\n<\/blockquote>\nTransfer\u64cd\u4f5cS3\u6dfb\u52a0\u7ba1\u7406\u5458\u89d2\u8272<\/h3>\n
\n
S3<\/code><\/li>\nGetObject<\/code>, GetObjectAcl<\/code>, s3:PutObject<\/code>, PutObjectAcl<\/code><\/li>\nSpecific<\/code>, \u5982arn:aws:s3:::ok-cloud-sftp\/*<\/code><\/li>\nTransferS3Admin<\/code><\/li>\n<\/ul>\n