MalformedPolicy aws config_error ai_generated true

调用 PutBucketPolicy 操作时出错 (MalformedPolicy)：策略使用了错误的条件键或值

An error occurred (MalformedPolicy) when calling the PutBucketPolicy operation: Policy has a conditional using the wrong key or value

ID: aws/s3-bucket-policy-conditional-check-failed

其他格式: JSON · Markdown 中文 · English
88%修复率
85%置信度
1证据数
2024-03-12首次发现

版本兼容性

版本状态引入弃用备注
AWS SDK v2 active — — —
AWS CLI 2.15.0 active — — —
S3 API 2006-03-01 active — — —

根因分析

S3 存储桶策略包含一个条件块，其中使用了无效或不支持的条件键（例如，aws:SourceIp 使用了非 IP 值）或格式错误的条件值。

English

S3 bucket policy contains a Condition block with an invalid or unsupported condition key (e.g., aws:SourceIp with a non-IP value) or a malformed condition value.

generic

官方文档

https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html

解决方案

  1. Validate the condition key against the S3 documentation. For example, use aws:SourceIp with a valid CIDR block: `aws:SourceIp`: ["192.0.2.0/24"]
  2. Use the AWS Policy Simulator to test the policy before applying it: aws iam simulate-custom-policy --policy-input-list file://policy.json
  3. Check for typos in condition key names (e.g., 'aws:SourceIp' vs 'aws:SourceIP') and ensure values are in the correct format (e.g., ARN for aws:SourceArn).

无效尝试

常见但无效的做法:

  1. 60% 失败

    The policy may be too permissive, exposing the bucket to unintended access.

  2. 70% 失败

    Condition keys like aws:SourceAccount or aws:SourceArn are account-specific and will fail validation.

  3. 80% 失败

    AWS condition keys are service-specific; using an unsupported key causes the policy to be rejected.