在我的案例中，这个错误的解决方案是试图删除我正在应用的一些动作。其中一些与此资源无关，或者不能使用此资源。 在这种情况下，它不让我包括这些:

GetBucketAcl ListBucket ListBucketMultipartUploads

您必须检查Policy-的Resource标记下定义的arn模式

“资源”:“当arn: aws s3::: s3mybucketname / *

在桶的公共访问策略被解除后，如果你遇到这个问题，在结尾添加“/*”将有助于解决这个问题。

无论何时尝试应用桶策略。记住这一点，如果你正在使用像“s3:ListBucket”，“s3:GetBucketPolicy”，“s3:GetBucketAcl”等与桶相关的操作，policy中的资源属性应该被提到为<" resource ": "arn:aws:s3:::bucket_name">。

Ex.

{
    "Version": "2012-10-17",
    "Id": "Policy1608224885249",
    "Statement": [
        {
            "Sid": "Stmt1608226298927",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetBucketPolicy",
                "s3:GetBucketAcl",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::bucket_name"
        }
    ]
}

如果您正在使用“s3:GetObject”、“s3:DeleteObject”、“s3:GetObject”等与对象相关的操作，则policy中的资源属性应提到为<" resource ": "arn:aws:s3:::bucket_name/*">。

ex.

{
  "Id": "Policy1608228066771",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1608228057071",
      "Action": [
        "s3:DeleteObject",
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::bucket_name/*",
      "Principal": "*"
    }
  ]
}

最后，如果你正在使用“s3:ListBucket”，“s3:GetObject”等操作，这些操作与桶和对象都相关，那么策略中的资源属性应该被提到为<" resource ": ["arn:aws:s3:::bucket_name/*"， " resource ": "arn:aws:s3:::bucket_name">。

ex.

{
    "Version": "2012-10-17",
    "Id": "Policy1608224885249",
    "Statement": [
        {
            "Sid": "Stmt1608226298927",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket_name",
                "arn:aws:s3:::bucket_name/*"
            ]
        }
    ] }

您可能有几个策略语句，这个错误是非常普遍的。最好的方法是注释除任何一个以外的所有其他语句(如GetObject，或ListBuckets，或PutObject)并执行代码并查看。如果工作正常，就意味着ARN路径是正确的。否则，ARN应该单独包含桶名或包含/*的桶名。

一些资源(如ListBucket)接受ARN的全名，如“ARN:aws:s3:::bucket_name”，而GetObject或PutObject要求bucket_name后面有一个/*。根据服务更改arn，现在应该可以工作了!

这很简单，只需要在结尾加上“/*”。您只给出了根目录链接，但是需要将操作应用到对象。

类型, “资源”:“在攻击:aws: s3::: surplace-audio / *”

您还可以为每个文件夹配置ListBuckets，如下所示

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSESPuts-1521238702575",
            "Effect": "Allow",
            "Principal": {
                "Service": "ses.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::buckets.email/*",
            "Condition": {
                "StringEquals": {
                    "aws:Referer": "[red]"
                }
            }
        },
        {
            "Sid": "Stmt1586754972129",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::596322993031:user/[red]"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::buckets.email",
            "Condition": {
                "StringEquals": {
                    "s3:delimiter": "/",
                    "s3:prefix": [
                        "",
                        "domain.co",
                        "domain.co/user"
                    ]
                }
            }
        },
        {
            "Sid": "Stmt1586754972129",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::596322993031:user/[red]"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::buckets.email",
            "Condition": {
                "StringLike": {
                    "s3:prefix": "domain.co/user/*"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::596322993031:user/[red]"
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::buckets.email/domain.co/user/*"
        }
    ]
}

这些规则与SES一起用于接收电子邮件，但允许外部用户查看SES放入bucket中的文件。 我按照这里的说明做了:https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/

此外，必须将prefix指定为域。co/user/ WITH在使用SDK时，否则你将被拒绝访问。希望能对大家有所帮助