AWS存储桶的策略声明优先顺序按照以下规则进行:
示例代码:
{ "Version": "2012-10-17", "Id": "S3PolicyId1", "Statement": [ { "Sid": "Stmt1", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111122223333:root" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::examplebucket/exampleobject" }, { "Sid": "Stmt2", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::444455556666:root" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::examplebucket/*" } ] }
在这个示例中,第二个声明是最广泛的声明,它适用于所有对象,并由根用户444455556666创建的AWS帐户进行访问。第一个声明更具体,只针对特定对象和由根用户111122223333创建的AWS帐户,因此应该放在第二个声明之前。