强制对 Amazon S3 存储桶实施有条件写入

通过使用 Amazon S3 存储桶策略，可以对通用存储桶中的对象上传强制实施有条件写入。

存储桶策略是基于资源的策略，您可以使用该策略向 Amazon S3 存储桶及其中的对象授予访问权限。只有存储桶拥有者才能将策略与存储桶关联。有关存储桶策略的更多信息，请参阅 Amazon S3 的存储桶策略。

您可以使用条件键 s3:if-match 或 s3:if-none-match 作为可选的 Condition 元素或 Condition 块来指定策略何时生效。对于分段上传，您必须指定 s3:ObjectCreationOperation 条件键以豁免 CreateMultipartUpload、UploadPart 和 UploadPartCopy 操作，因为这些 API 不接受有条件标头。有关在存储桶策略中使用条件的更多信息，请参阅使用条件键的存储桶策略示例。

以下示例说明如何使用存储桶策略中的条件来强制客户端使用 If-None-Match 或 If-Match HTTP 标头。

示例 1：仅支持使用包含 if-none-match 标头的 PutObject 和 CompleteMultipartUpload 请求上传对象

如果请求包含 if-none-match 标头，则此策略支持账户 111122223333（用户 Alice）写入 amzn-s3-demo-bucket1 存储桶，从而确保存储桶中不存在对象键。针对指定存储桶的所有 PutObject 和 CompleteMultipartUpload 请求都必须包含 if-none-match 标头才能获得成功。使用此标头，仅当存储桶中不存在对象键时，客户才能写入该存储桶。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowConditionalPut",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
            "Condition": {
                "Null": {
                    "s3:if-none-match": "false"
                }
            }
        },
        {
            "Sid": "AllowConditionalPutwithMPUs",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
            "Condition": {
                "Bool": {
                    "s3:ObjectCreationOperation": "false"
                }
            }
        }
    ]
}

示例 2：仅支持使用包含 if-match 标头的 PutObject 和 CompleteMultipartUpload 请求上传对象

只有在请求包含 if-match 标头的情况下，此策略才支持账户 111122223333（用户 Alice）写入 amzn-s3-demo-bucket1。此标头将 S3 中对象的 ETag 值与您在 WRITE 操作期间提供的值进行比较。如果 ETag 值不匹配，则操作将失败。针对指定存储桶的所有 PutObject 和 CompleteMultipartUpload 请求都必须包含 if-match 标头才能获得成功。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPutObject",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
        },
        {
            "Sid": "BlockNonConditionalObjectCreation",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
            "Condition": {
                "Null": {
                    "s3:if-match": "true"
                },
                "Bool": {
                    "s3:ObjectCreationOperation": "true"
                }
            }
        },
        {
            "Sid": "AllowGetObjectBecauseConditionalPutIfMatchETag",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*"
        }
    ]
}

示例 3：仅支持包含 if-none-match 或 if-match 标头的对象上传请求

如果请求包含 if-none-match 或 if-match 标头，则此策略支持账户 111122223333（用户 Alice）写入 amzn-s3-demo-bucket1。这可让 Alice 在存储桶中不存在键名称的情况下上传对象，或者，如果键名称确实存在，当对象 ETag 与 PUT 请求中提供的 ETag 匹配时，Alice 可以覆盖该对象。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": " AllowConditionalPutifAbsent",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
            "Condition": {
                "Null": {
                    "s3:if-none-match": "false"
                }
            }
        },
        {
            "Sid": "AllowConditionalPutIfMatchEtag",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
            "Condition": {
                "Null": {
                    "s3:if-match": "false"
                }
            }
        },
        {
            "Sid": "AllowConditionalObjectCreation",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*",
            "Condition": {
                "Bool": {
                    "s3:ObjectCreationOperation": "false"
                }
            }
        },
        {
            "Sid": " AllowGetObjectBecauseConditionalPutIfMatchETag",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/Alice"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::amzn-s3-demo-bucket1/*"
        }
    ]
}