[{"data":1,"prerenderedAt":160},["ShallowReactive",2],{"content:\u002Fposts\u002Fminio-bucket-policy":3,"surround:\u002Fposts\u002Fminio-bucket-policy":150},{"id":4,"title":5,"body":6,"categories":125,"date":127,"description":128,"draft":129,"extension":130,"image":131,"meta":132,"navigation":134,"path":135,"permalink":131,"pinned":129,"published":131,"readingTime":136,"recommend":131,"references":131,"seo":141,"sitemap":142,"stem":143,"tags":144,"type":148,"updated":127,"__hash__":149},"content\u002Fposts\u002Fposts\u002Fminio-bucket-policy.md","MinIO 存储桶安全策略配置",{"type":7,"value":8,"toc":118},"minimark",[9,19,30,36,47,51,69,73,80,90,93,100,106],[10,11,15],"alert",{"type":12,"icon":13,"title":14},"info","tabler:robot","AI 迁移提示",[16,17,18],"p",{},"本文由 AI 协助从旧站迁移，尚未完成逐篇人工审校；内容如有疏漏，将在复核后修订。",[10,20,22],{"type":21},"warning",[16,23,24,25,29],{},"将存储桶配置为 ",[26,27,28],"code",{"code":28},"public"," 后，任何人均可通过 HTTP 请求直接上传、删除和列目录。应通过自定义策略严格限制操作权限。",[16,31,32,33,35],{},"将 MinIO 存储桶配置为 ",[26,34,28],{"code":28}," 后，任何人均可通过 HTTP 请求直接操作存储桶内容。应通过自定义存储桶策略限制操作权限。",[37,38,39,42],"blockquote",{},[16,40,41],{},"尚未部署 MinIO？参见",[43,44],"link-card",{"link":45,"title":46},"\u002Fposts\u002Fminio-install","MinIO 对象存储安装指南",[48,49,50],"h2",{"id":50},"问题原因",[16,52,53,54,56,57,60,61,64,65,68],{},"MinIO 的 ",[26,55,28],{"code":28}," 策略等同于完全开放，包括列目录（",[26,58,59],{"code":59},"s3:ListBucket","）、上传（",[26,62,63],{"code":63},"s3:PutObject","）、删除（",[26,66,67],{"code":67},"s3:DeleteObject","）等操作均无限制。",[48,70,72],{"id":71},"推荐策略仅允许公共读","推荐策略：仅允许公共读",[16,74,75,76,79],{},"以下策略允许任何人读取文件（",[26,77,78],{"code":78},"GetObject","），但禁止写入、删除和列目录：",[81,82,88],"pre",{"className":83,"code":85,"language":86,"meta":87},[84],"language-json","{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": \"*\",\n      \"Action\": [\"s3:GetObject\"],\n      \"Resource\": [\"arn:aws:s3:::your-bucket-name\u002F*\"]\n    },\n    {\n      \"Effect\": \"Deny\",\n      \"Principal\": \"*\",\n      \"Action\": [\n        \"s3:PutObject\",\n        \"s3:DeleteObject\",\n        \"s3:PutBucketPolicy\",\n        \"s3:DeleteBucketPolicy\"\n      ],\n      \"Resource\": [\n        \"arn:aws:s3:::your-bucket-name\",\n        \"arn:aws:s3:::your-bucket-name\u002F*\"\n      ]\n    }\n  ]\n}\n","json","",[26,89,85],{"__ignoreMap":87},[48,91,92],{"id":92},"仅禁止列目录",[16,94,95,96,99],{},"如果只需防止目录遍历，可单独添加以下 ",[26,97,98],{"code":98},"Deny"," 规则：",[81,101,104],{"className":102,"code":103,"language":86,"meta":87},[84],"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Deny\",\n      \"Principal\": \"*\",\n      \"Action\": \"s3:ListBucket\",\n      \"Resource\": \"arn:aws:s3:::your-bucket-name\"\n    }\n  ]\n}\n",[26,105,103],{"__ignoreMap":87},[16,107,108,109,112,113,117],{},"将 ",[26,110,111],{"code":111},"your-bucket-name"," 替换为实际存储桶名称，然后在 MinIO Console 的 ",[114,115,116],"strong",{},"Bucket → Access Policy"," 中粘贴并保存即可。",{"title":87,"searchDepth":119,"depth":119,"links":120},4,[121,123,124],{"id":50,"depth":122,"text":50},2,{"id":71,"depth":122,"text":72},{"id":92,"depth":122,"text":92},[126],"技术","2026-01-21 00:00:00","通过配置 MinIO 存储桶 JSON 策略，限制 ListBucket 等危险操作，防止存储桶文件目录泄露。",false,"md",null,{"slots":133},{},true,"\u002Fposts\u002Fminio-bucket-policy",{"text":137,"minutes":138,"time":139,"words":140},"2 min read",1.495,89700,299,{"title":5,"description":128},{"loc":135},"posts\u002Fposts\u002Fminio-bucket-policy",[145,146,147],"MinIO","对象存储","安全","tech","aUbcPe_UMsR1JK0rSeLWpXnVncKZF3jcGIpO4L4hWJY",[151,155],{"title":152,"path":45,"stem":153,"date":154,"type":148,"children":-1},"MinIO 对象存储部署与安全策略指南","posts\u002Fposts\u002Fminio-install","2026-01-20",{"title":156,"path":157,"stem":158,"date":159,"type":148,"children":-1},"Nacos 安装与鉴权配置指南","\u002Fposts\u002Fnacos-guide","posts\u002Fposts\u002Fnacos-guide","2026-01-22",1788712225042]