企业官网建设流程全解析

1.只读

下载对象 ✅ 读取对象 ✅

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ReadObjectsOnly", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40/*" ] } ] }

2.只允许读取 artifacts/ 目录

cc-cn-nx-s3-b40 ├── artifacts/ │ ├── server │ └── config.ini ├── logs/ ├── static/ └── backup/

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ReadArtifactsOnly", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40/artifacts/*" ] } ] }

3. 如果希望“查看桶里的文件列表”

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ListBucket", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40" ] } ] }

4.最实用的“只读权限”

能查看桶里的文件 + 能下载文件，但不能修改。查看目录 ✅ 查看对象 ✅ 下载对象 ✅

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ListBucket", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40" ] }, { "Sid": "ReadObjects", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40/*" ] } ] }

5. 如果希望“写入 S3”

下载 ❌ 列目录 ❌ 删除 ❌

{ "Version": "2012-10-17", "Statement": [ { "Sid": "WriteObjectsOnly", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40/*" ] } ] }

6.如果只允许写日志目录

{ "Version": "2012-10-17", "Statement": [ { "Sid": "WriteLogsOnly", "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40/logs/*" ] } ] }

7. 如果希望“读取 + 写入”

列文件 ✅

下载 ✅

上传 ✅

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ListBucket", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40" ] }, { "Sid": "ReadWriteObjects", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40/*" ] } ] }

8. 如果还希望可以删除

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ListBucket", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40" ] }, { "Sid": "ReadWriteDeleteObjects", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40/*" ] } ] }

9. 如果只想查看 artifacts/，而不是整个 Bucket

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ListArtifactsOnly", "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40" ], "Condition": { "StringLike": { "s3:prefix": [ "artifacts", "artifacts/*" ] } } }, { "Sid": "ReadArtifactsOnly", "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws-cn:s3:::cc-cn-nx-s3-b40/artifacts/*" ] } ] }

S3创建生命周期

server v1 ↓ 上传新版本 server v2 ← 当前版本，保留 │ server v1 ← 非当前版本 │ └── 90天后自动删除 CC-S3-Rule 范围： 整个 Bucket 当前版本： 非当前版本： 90 天后永久删除 ✅ 过期删除标记： 清理 ✅ 未完成分段上传： 7 天后删除 ✅