从不同环境中的配置文件上载到AWS S3 bucket

我可以访问两个AWS环境中的一个,我在其中创建了一个受保护的S3 bucket,以便从一个我没有的帐户上载文件。我无法访问的环境和帐户是项目CI使用的内容。

• 我可以访问的环境: env1
• 我无法访问的环境: env2
• user/ci
• content

S3桶策略:

{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            ...
        },
        {
            "Sid": "Allow access to bucket from profile in env1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/ci"
            },
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket*"
            ],
            "Resource": "arn:aws:s3:::content"
        },
        {
            "Sid": "Allow access to bucket items from profile in env1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/ci"
            },
            "Action": [
                "s3:Get*",
                "s3:PutObject",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::content",
                "arn:aws:s3:::content/*"
            ]
        }
    ]
}

从配置为 环境1 和 我在用命令测试

aws s3 sync content/ s3://content/

我得到一个错误:

fatal error: An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

我有两个问题:

1. 我用的是正确的吗 aws
2. 我的水桶政策有什么遗漏吗?

对于后者,我基本上遵循了网上大量的例子和答案。