使用 OIDC 组条件的访问策略在用户是另一个在访问策略中使用的组成员时不会授予 admin:* 权限

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:DeleteObjectTagging", "s3:GetBucketTagging", "s3:PutBucketTagging", "s3:DeleteObject", "s3:GetBucketPolicy", "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetObject", "s3:HeadBucket", "s3:ListBucket", "s3:PutObject", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutObjectTagging", "s3:GetObjectTagging" ], "Resource": [ "arn:AWS:s3:::klm-/", "arn:AWS:s3:::klm-" ], "Condition": { "ForAnyValue:StringEquals": { "jwt:groups": [ "Team-Dev-1" ] } } }, { "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:PutObject", "s3:DeleteObject", "s3:GetBucketTagging", "s3:HeadBucket", "s3:CreateBucket", "s3:PutBucketTagging", "s3:GetBucketPolicy", "s3:GetObject", "s3:GetObjectTagging", "s3:ListBucket", "s3:PutObjectTagging", "s3:DeleteBucket", "s3:DeleteObjectTagging", "s3:GetBucketLocation" ], "Resource": [ "arn:AWS:s3:::hij-/", "arn:AWS:s3:::hij-" ], "Condition": { "ForAnyValue:StringEquals": { "jwt:groups": [ "Team-Dev-2" ] } } }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteObjectTagging", "s3:GetBucketPolicy", "s3:ListBucket", "s3:GetBucketLocation", "s3:GetBucketTagging", "s3:GetObjectTagging", …