建立目錄時，使用AWS S3和Flysystem出現"無法在指定位置寫入檔案... AccessDenied"錯誤

Question

我在嘗試在 AWS S3 上使用 Flysystem 建立目錄時遇到了一些困難 - 我不斷收到 AccessDenied 回應。我的儲存桶具有所有公共存取權 blocked，但儲存桶策略允許發送請求的使用者對其執行所有操作：

{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "AllowCloudFrontServicePrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-local-bucket/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::***:distribution/***"
                }
            }
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::***:user/local"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-local-bucket/*"
        }
    ]
}

還有我的 local 使用者策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*",
                "s3-object-lambda:*"
            ],
            "Resource": "*"
        }
    ]
}

我可以上傳檔案絕對沒問題 - 只是目錄，例如 images/blog 等，我收到 LeagueFlysystemUnableToWriteFile::atLocation 異常並拋出以下錯誤：

Error executing "PutObject" on "https://s3.eu-west-2.amazonaws.com/my-local-bucket/images/blog/"; AWS HTTP error: Client error: `PUT https://s3.eu-west-2.amazonaws.com/my-local-bucket/images/blog/` resulted in a `403 Forbidden` response: <?xml version="1.0" encoding="UTF-8"?> <Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>***(truncated...)  AccessDenied (client): Access Denied - <?xml version="1.0" encoding="UTF-8"?> <Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>***</RequestId><HostId>***</HostId></Error>

知道是什麼原因造成的嗎？

Answer 1

經過幾週的嘗試尋找答案，我發現如果我在創建 s3 驅動程式時將 visibility 作為 private 並通過配置傳遞，那麼它確實可以正常工作。