AWS Config Bucket Policy是AWS服务中用来定义对于存储AWS Config记录的S3存储桶的网络策略的一种语言。以下是定义允许AWS Config服务访问您的S3存储桶的默认政策:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSConfigBucketPermissionsCheck",
"Effect": "Allow",
"Principal": {
"Service": "config.amazonaws.com"
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::examplebucket"
},
{
"Sid": " AWSConfigBucketDelivery",
"Effect": "Allow",
"Principal": {
"Service": "config.amazonaws.com"
},
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::examplebucket/AWSLogs/account-id/*",
"arn:aws:s3:::examplebucket/config/*"
],
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
其中包括了两条语句,第一条用来检查AWS Config服务是否有访问您的S3存储桶权限的语句,第二条用来允许AWS Config服务向存储桶上传和读取记录文件。
如果您需要更改此政策,可以通过AWS控制台或AWS CLI进行更改。需要注意的是,任何更改都可能影响到您的AWS Config服务,并需要特别谨慎。