sso 用户的 s3 存储桶策略

我想允许特定角色“test-role”在特定存储桶“test-bucket”上执行所有 s3 操作。拒绝为所有其他人提供桶。我写的 s3 策略：

{
 "Version": "2012-10-17",
 "Id": "Policy1601973417173",
 "Statement": [
 {
 "Sid": "Allow role test-role",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::xxxxxxxx:role/test-role"
 },
 "Action": "s3:*",
 "Resource": "arn:aws:s3:::test-bucket/*"
 },
 {
 "Sid": "Deny rest",
 "Effect": "Deny",
 "NotPrincipal": {
 "AWS": "arn:aws:iam::xxxxxxxx:role/test-role"
 },
 "Action": "s3:*",
 "Resource": "arn:aws:s3:::test-bucket/*"
 }
 ]
}

即使应用上述策略后，映射到角色“test-role”的 sso 用户在存储桶上的访问仍被拒绝。

注意：AWS 控制台将登录用户显示为“联合登录：test-role/[电子邮件受保护] /cdn-cgi/l/email-protection".

我也尝试过“假定角色”选项仍然失败。任何帮助表示赞赏。

尝试这个：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::test-bucket",
                "arn:aws:s3:::test-bucket/*"
            ],
            "Condition": {
                "StringNotLike": {
                    "aws:userId": [
                        "AIDA<udserid-1-suppressed>:*",
                        "AIDA<udserid-1-suppressed>",
                        "AIDA<udserid-2-suppressed>:*",
                        "AIDA<udserid-2-suppressed>",
                        "AIDA<udserid-n-suppressed>:*",
                        "AIDA<udserid-n-suppressed>",
                        "111111111111"
                    ]
                }
            }
        }
    ]
}