152 字
1 分钟
解决minio访问存储桶文件目录泄露问题
配置存储桶策略 (Bucket Policy)
MinIO 支持基于 JSON 的存储桶策略,您可以配置这些策略来严格控制谁可以对存储桶执行哪些操作。为了防止存储桶文件目录泄露,您应该配置一个拒绝 s3
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Principal": "*", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::your-bucket-name" } ]}我们可以配置自定义的策略,公共读,不允许写入删除等操作
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "*", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::your-bucket-name/*" ] }, { "Effect": "Deny", "Principal": "*", "Action": [ "s3:PutObject", "s3:DeleteObject", "s3:PutBucketPolicy", "s3:DeleteBucketPolicy" ], "Resource": [ "arn:aws:s3:::your-bucket-name", "arn:aws:s3:::your-bucket-name/*" ] } ]}将 your-bucket-name 替换为您实际的存储桶名称。这个策略会阻止任何人列出该存储桶的内容,除非他们有显式权限。
如果这篇文章对你有帮助,欢迎分享给更多人!
发现错误或想要改进这篇文章?
在 GitHub 上编辑此页 解决minio访问存储桶文件目录泄露问题
https://m.olinl.com/posts/minio-policy/