为了解决这个问题,可以通过在Transfer服务的身份提供者或用户角色策略中添加“Put”操作来允许用户将文件上传到目录中,同时仍然禁止用户列出目录。下面是一个示例策略:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowListingDirectories",
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::your-bucket-name"
},
{
"Sid": "DenyListingDirectories",
"Effect": "Deny",
"Action": [
"s3:ListBucket"
],
"Resource": "arn:aws:s3:::your-bucket-name",
"Condition": {
"StringNotLike": {
"s3:prefix": [
"",
"directory-path/*"
]
}
}
},
{
"Sid": "AllowWritingFiles",
"Effect": "Allow",
"Action": [
"s3:PutObject"
],
"Resource": "arn:aws:s3:::your-bucket-name/directory-path/*"
}
]
}
以上策略允许用户上传到指定的目录路径中,并禁止列出此路径外的所有内容。但是,用户可以通过确切的路径名称来访问此目录,例如:sftp://transfer-server-name/directory-path/file-name.txt