±à¼ÍƼö: |
±¾ÎÄÀ´×ÔÓÚamazonaws-china.com£¬ËùÊöµÄ½â¾ö·½°¸Ê¹Óô洢Ͱ²ßÂÔÀ´¹ÜÀí¶Ô
S3 ´æ´¢Í°µÄ·ÃÎÊ ¨C ¼´Ê¹ÊµÌå¿ÉÒÔ·ÃÎÊÍêÕûµÄ S3 API¡£ |
|
½â¾ö·½°¸¸ÅÊö
±¾ÎÄËùÊöµÄ½â¾ö·½°¸Ê¹Óô洢Ͱ²ßÂÔÀ´¹ÜÀí¶Ô S3 ´æ´¢Í°µÄ·ÃÎÊ ¨C ¼´Ê¹ÊµÌå¿ÉÒÔ·ÃÎÊÍêÕûµÄ S3 API¡£ÏÂͼչʾÁ˴˽â¾ö·½°¸ÈçºÎÓ¦ÓÃÓÚͬһÕË»§ÄڵĴ洢Ͱ¡£

1.IAM Óû§µÄ²ßÂԺͽÇÉ«µÄÓû§²ßÂÔÊÚÓè¶Ô ¡°s3:*¡± µÄ·ÃÎÊȨÏÞ¡£
2.S3 ´æ´¢Í°²ßÂÔ½«·ÃÎÊȨÏÞÏÞÖÆÎª½öÏ޸ýÇÉ«¡£
3.IAM Óû§ºÍ½ÇÉ«¶¼¿ÉÒÔ·ÃÎʸÃÕË»§ÖеĴ洢Ͱ¡£¸Ã½ÇÉ«¿ÉÒÔ·ÃÎÊÕâÁ½¸ö´æ´¢Í°£¬µ«Óû§Ö»ÄÜ·ÃÎÊûÓи½¼Ó´æ´¢Í°²ßÂԵĴ洢Ͱ¡£¼´Ê¹½ÇÉ«ºÍÓû§¶¼ÓµÓÐÍêÕûµÄ
¡°s3:*¡± ȨÏÞ£¬´æ´¢Í°²ßÂÔÈÔ»á¾Ü¾øÈκβ»¾ßÓиýÇÉ«µÄÈËÔ±·ÃÎʸô洢Ͱ¡£
¿çÕË»§·½·¨µÄÖ÷Òª²»Í¬Ö®´¦ÔÚÓÚ£¬Ã¿¸ö´æ´¢Í°±ØÐ븽¼Ó´æ´¢Í°²ßÂÔ¡£ÏÂͼչʾÁËÕâÖÖ·½·¨ÈçºÎÓ¦ÓÃÓÚ¿çÕË»§²¿Ê𳡾°¡£

1.IAM ½ÇÉ«µÄÓû§²ßÂԺʹ洢ͰÕË»§ÖÐµÄ IAM Óû§²ßÂÔ¾ùÊÚÓè¶Ô¡°s3:*¡±µÄ·ÃÎÊȨÏÞ
2.Èç¹ûÈκÎÈ赀 user:id Óë½ÇÉ«µÄÏàÓ¦Öµ²»Í¬£¬²¢ÇÒ²ßÂÔ¶¨ÒåÁËÔÊÐí½ÇÉ«¶Ô´æ´¢Í°Ö´ÐÐÄÄЩ²Ù×÷£¬Ôò´æ´¢Í°²ßÂÔ»á¾Ü¾øÆä·ÃÎÊ¡£
3.´æ´¢Í°²ßÂÔÔÊÐí´ÓÆäËûÕË»§·ÃÎʽÇÉ«¡£
4.IAM Óû§ºÍ½ÇÉ«¿ÉÒÔÔڴ洢Ͱ²ßÂÔÖÐûÓÐ Deny µÄÇé¿öÏ·ÃÎʴ洢Ͱ¡£½ÇÉ«¿ÉÒÔͬʱ·ÃÎÊÕâÁ½¸ö´æ´¢Í°£¬ÒòΪ
Deny ½öÊÊÓÃÓÚÆä user:id ²»µÈÓÚ½ÇÉ«µÄÏàÓ¦ÖµµÄÖ÷Ìå¡£
Á˽â NotPrincipal ÔªËØ¼°ÆäÓ÷¨
Äú¿ÉÒÔʹÓà IAM »ò S3 ´æ´¢Í°²ßÂ﵀ NotPrincipal ÔªËØ£¬½öÏÞÌØ¶¨Óû§×é·ÃÎÊ×ÊÔ´¡£´ËÔªËØÔÊÐíÄú×èֹδÔÚÆäÖµÊý×éÖж¨ÒåµÄËùÓÐÓû§£¬¼´Ê¹ËûÃÇ×Ô¼ºµÄ
IAM Óû§²ßÂÔÖоßÓÐ Allow Ò²ÊÇÈç´Ë¡£Òò´Ë£¬Èç¹ûÄúÓÐÒ»¸öÓû§Ó¦¸Ã¿ÉÒÔ·ÃÎʳý S3 ÖеÄij¸ö´æ´¢Í°ÒÔÍâµÄËùÓд洢Ͱ£¬Ôò¿ÉÒÔÔڸô洢Ͱ±¾ÉíÉϽøÐд˶¨Ò壬¶øÎÞÐè±à¼Óû§µÄ
IAM ²ßÂÔ¶ÑÕ»¡£
µ«¶ÔÓÚ IAM ½ÇÉ«À´Ëµ£¬ÕâÒª¸üΪ¸´ÔÓ£¬ÒòΪ½ÇÉ«ÊÇÓÉ Principal
ÖеÄÁ½¸ö ARN ¶¨ÒåµÄ£ºrole ARN ºÍ assumed-role ARN¡£role ARN
(arn:aws:iam: :ACCOUNTNUMBER:role/ROLE-NAME) ÊǾ²Ì¬µÄ£¬¶ÀÁ¢ÓÚ½ÇÉ«»á»°·¢ÆðÕß¡££¨ÔÚ±¾ÎÄÖУ¬Çмǽ«
placeholder information Ìæ»»ÎªÄú×Ô¼ºµÄÕË»§ÐÅÏ¢¡££©assumed-role
ARN (arn: aws:sts: :ACCOUNTNUMBER: assumed- role /ROLE-
NAME /ROLE- SESSION- NAME) ½«ÒòΪ½ÇÉ«»á»°Ãû³Æ¶¨ÒåµÄÄÚÈݶøÒì¡£¶ÔÓÚ¾ßÓÐÒ»¸ö½ÇÉ«µÄÓû§·¢³öµÄ
API µ÷Óã¬Äú¿ÉÒÔͨ¹ý²é¿´ AWS CloudTrail ÌõÄ¿ÖеÄÒÔÏ Identity ÔªËØÀ´Á˽â´ËÐÅÏ¢¡£
{ "type": "AssumedRole",
"principalId": "AROAJI4AVVEXAMPLE:
ROLE- SESSION- NAME ",
"arn": "arn:aws: sts: :ACCOUNTNUMBER
:assumed-role /ROLE- NAME /ROLE- SESSION- NAME
",
"accountId" : "ACCOUNTNUMBER",
"accessKeyId" : "ASIAEXAMPLEKEY",
"sessionContext" : {
"attributes" : {
"mfaAuthenticated" : "false",
"creationDate" : "XXXX- XX- XXTXX
:XX :XXZ "
},
"sessionIssuer" : {
"type": "Role" ,
"principalId" : "AROAJI4AVV3EXAMPLEID",
"arn" : "arn:aws:iam: :ACCOUNTNUMBER:
role /ROLE- NAME ",
"accountId" : "ACCOUNTNUBMER"
,
"userName" : "ROLE- SESSION- NAME"
}
}
} |
ÔÚ´Ë Identity ÔªËØÖУ¬Äú¿ÉÒÔ¿´µ½ role ARN ºÍ assumed-
role ARN¡£¸ù¾Ý³Ðµ£½ÇÉ«µÄÓû§²»Í¬£¬ROLE-SESSION- NAME Ò²¿ÉÄÜ»áÓÐËù±ä»¯¡£principalId
ÖµÒ²°üº¬´ËÐÅÏ¢£¬µ«²ÉÓÿÉÒÔÔڴ洢Ͱ²ßÂ﵀ Principal ÔªËØÒÔÍâʹÓõķ½Ê½ÉèÖøñʽ¡£ÔÚ±àд´æ´¢Í°²ßÂÔʱ£¬ÎÒ»áʹÓÃÕâЩÐÅÏ¢¡£
ÏòÌØ¶¨½ÇÉ«ÊÚÓèͬÕË»§´æ´¢Í°·ÃÎÊȨÏÞ
ÔÚ´ÓͬһÕË»§·ÃÎʴ洢Ͱʱ£¬ÔÚ´ó¶àÊýÇé¿öϲ»±ØÊ¹Óô洢Ͱ²ßÂÔ¡£ÕâÊÇÒòΪ´æ´¢Í°²ßÂÔ¶¨ÒåÁËÒÑÓÉÓû§µÄÖ±½Ó
IAM ²ßÂÔÊÚÓèµÄ·ÃÎÊȨÏÞ¡£S3 ´æ´¢Í°²ßÂÔͨ³£ÓÃÓÚ¿çÕË»§·ÃÎÊ£¬µ«ÄúÒ²¿ÉÒÔʹÓÃËüÃÇ£¬Í¨¹ýÏÔʽ Deny
À´ÏÞÖÆ·ÃÎÊ£¬Õ⽫ӦÓÃÓÚËùÓÐÖ÷Ì壬ÎÞÂÛÊÇÓë´æ´¢Í°Î»ÓÚÏàͬÕË»§Öл¹ÊDz»Í¬ÕË»§ÖеÄÖ÷Ìå¡£
ÿ¸ö IAM ʵÌ壨Óû§¡¢×é»ò½ÇÉ«£©¶¼ÓÐÒ»¸öÒѶ¨ÒåµÄ aws:userid
±äÁ¿¡£ÄúÐèÒªÔڴ洢Ͱ²ßÂÔÖÐʹÓô˱äÁ¿£¬²ÅÄÜÔÚÌõ¼þÔªËØÄÚÒÔÀýÍâµÄÐÎʽָ¶¨½ÇÉ«»òÓû§¡£assumed-
role µÄ aws:userId Öµ¶¨ÒåΪ UNIQUE-ROLE- ID:ROLE- SESSION-
NAME£¨ÀýÈç AROAEXAMPLEID: userdefinedsessionname£©¡£
Òª»ñµÃ IAM ½ÇÉ«µÄ AROAEXAMPLEID£¬ÇëÖ´ÐÐÒÔϲÙ×÷£º
1.Îñ±Ø°²×° AWS CLI£¬²¢´ò¿ªÒ»¸öÃüÁîÌáʾ·û»ò shell¡£
2.ÔËÐÐÒÔÏÂÃüÁaws iam get-role -¨Crole-name
ROLE-NAME¡£
3.ÔÚÊä³öÖУ¬²éÕÒÒÔ AROA ¿ªÍ·µÄ RoleId ×Ö·û´®¡£Äú½«Ôڴ洢Ͱ²ßÂÔÖÐʹÓÃËüÀ´½«´æ´¢Í°·ÃÎÊȨÏ޵ķ¶Î§½öÏÞÓڴ˽ÇÉ«¡£
ÔÚǰÊö CloudTrail ´úÂëʾÀýÖУ¬´Ë ID Ϊ principalId ÔªËØ¡£´ËÔªËØµÄֵʮ·ÖÖØÒª£¬ÒòΪ
AWS ²ßÂÔ±äÁ¿Ò²¿ÉÒÔÔÚ IAM ²ßÂÔÖÐ×÷Ϊ×Ö·û´®½øÐмì²é¡£Äú²»±ØÔÚ NotPrincipal ÔªËØÖÐÖ¸¶¨
role ºÍ assumed-role ARN£¬¶øÊÇ¿ÉÒÔ½« StringNotLike Ìõ¼þÖÐµÄ aws:userId
ÖµÓëͨÅä·û×Ö·û´®Ò»ÆðʹÓá£ÔÚ aws:userId ÖµÄÚ£¬Äú»¹ÐèÒªÌí¼ÓÕË»§µÄ Root Óû§£¬ÒÔ±ãÔÚɾ³ý¶¨ÒåµÄ½Çɫʱ£¬²»»áÖÂʹ´æ´¢Í°ÍêÈ«ÎÞ·¨·ÃÎÊ¡£Root
ÕË»§µÄ userId ÊÇÕË»§±àºÅ¡£
ʹÓÃÄú¸Õ¸Õͨ¹ý AWS CLI ¼ìË÷µÄ AROAEXAMPLEID£¬¼´¿É´´½¨Ìõ¼þÂß¼£¬Èô洢Ͱ²ßÂÔ½«´æ´¢Í°·ÃÎÊȨÏ޵ķ¶Î§½öÏÞÓÚ·ÃÎʴ洢ͰʱʹÓô˽ÇÉ«µÄÓû§¡£Ê¹ÓÃÌõ¼þÂß¼¶ø·Ç
NotPrincipal ÔªËØ¿ÉÖ§³ÖʹÓÃͨÅä·û×Ö·û´®£¬´Ó¶øÔÊÐí½ÓÊÜÈκνÇÉ«»á»°Ãû³Æ¡£
ÏÖÔÚÄúÒÑ»ñµÃÒªÔÊÐíÆä·ÃÎʵĽÇÉ« ID£¬½ÓÏÂÀ´ÐèÒª×èÖ¹Óë´æ´¢Í°´¦ÓÚÏàͬÕË»§Ä򵀮äËûÓû§µÄ·ÃÎÊ¡£×èֹδʹÓÃ
IAM ½ÇÉ«»ò Root ÕË»§Æ¾Ö¤µÄÓû§·ÃÎʴ洢Ͱ¼°Æä¶ÔÏóµÄ²ßÂÔÈçÏÂËùʾ¡£
{
"Version": " 2012-10-17 ",
"Statement" : [
{
"Effect" : "Deny",
"Principal" : "*",
"Action" : "s3:*",
"Resource" : [
"arn:aws:s3: ::MyExampleBucket",
"arn:aws:s3: ::MyExampleBucket/*"
],
"Condition" : {
"StringNotLike" : {
"aws:userId" : [
"AROAEXAMPLEID :* ",
"111111111111"
]
}
}
}
]
} |
ÄúÒ²¿ÉÒÔ¶Ô IAM Óû§Ê¹ÓÃÏàͬµÄ²ßÂÔ¡£IAM Óû§ÓµÓÐÒ»¸öÒÔ AIDA ¿ªÍ·µÄΨһ ID£¬Äú¿ÉÒÔ½«´Ë
ID ÓÃÓÚ´ËÓÃ;¡£Òª²éÕÒ´ËΨһ ID£¬ÇëÖ´ÐÐÒÔϲÙ×÷£º
1.°²×° AWS CLI ºó£¬´ò¿ªÃüÁîÌáʾ·û»ò shell¡£
2.ÔËÐÐÃüÁaws iam get-user -¨Cuser-name
USER-NAME
3.ÔÚÊä³öÖУ¬²éÕÒÒÔ AIDAEXAMPLEID ¿ªÍ·µÄ userId
×Ö·û´®¡£
ÕÒµ½ userId ×Ö·û´®Ö®ºó£¬Äú¿ÉÒÔ½«ÆäÖÃÓÚ¡°aws:userId¡±Ìõ¼þÊý×éÖУ¬ÈçÒÔÏÂʾÀýËùʾ¡£
{
"Version": " 2012-10-17 ",
"Statement" : [
{
"Effect" : "Deny",
"Principal" : "*",
"Action" : "s3:*",
"Resource" : [
"arn:aws:s3: ::MyExampleBucket",
"arn:aws:s3: ::MyExampleBucket/*"
],
"Condition" : {
"StringNotLike" : {
"aws:userId" : [
"AROAEXAMPLEID : * ",
"AIDAEXAMPLEID" , "111111111111"
]
}
}
}
]
} |
ÏòÌØ¶¨ IAM ½ÇÉ«ÊÚÓè¿çÕË»§´æ´¢Í°·ÃÎÊȨÏÞ
ÔÚÉÏÒ»½ÚÖУ¬ÎÒÏòÄúչʾÁËÈçºÎ½« S3 ´æ´¢Í°·ÃÎÊȨÏÞÏÞÓÚͬһ¸öÕË»§ÄÚµÄÌØ¶¨
IAM ½ÇÉ«»òÓû§¡£ÏÖÔÚ£¬ÎÒ½«ÏòÄúչʾÈçºÎ½«·ÃÎÊȨÏÞÏÞÖÆµ½ÁíÒ»ÕË»§ÖеÄÌØ¶¨Óû§ºÍ½ÇÉ«¡£Ïò IAM Óû§»ò½ÇÉ«ÊÚÓè¿çÕË»§´æ´¢Í°·ÃÎÊȨÏÞʱ£¬Äú±ØÐ붨ÒåÔÊÐí
IAM Óû§»ò½Çɫͨ¹ý¸Ã·ÃÎÊȨÏÞÖ´ÐÐÄÄЩ²Ù×÷¡£ÔÚÏÈǰµÄ AWS °²È«ÐÔ²©¿ÍÖУ¬Jim Scharf
׫ÎĽéÉÜÁËÔÊÐí IAM ʵÌåͨ¹ý CLI/API ºÍ¿ØÖÆÌ¨·ÃÎʴ洢ͰËùÐèµÄȨÏÞ¡£ÀûÓÃ֮ǰÕâÆª²©ÎÄÖÐÌṩµÄÐÅÏ¢£¬CLI/API
¼¶·ÃÎʴ洢Ͱ²ßÂÔÓ¦ÈçÏÂËùʾ¡£
{
"Version": " 2012-10-17",
"Statement": [
{ "Effect": "Allow",
"Principal": {
"AWS ": "arn:aws:iam: :111111111111:role
/ROLENAME "
} ,
"Action" : "s3:ListBucket",
"Resource": "arn:aws:s3: ::MyExampleBucket"
},
{
"Effect" : "Allow",
"Principal": {
"AWS": "arn:aws :iam: :111111111111
:role /ROLENAME"
},
"Action" : [
"s3 :GetObject",
"s3 :PutObject",
"s3 :DeleteObject"
],
"Resource" : "arn:aws:s3: ::MyExampleBucket/
*"
},
{
"Effect" : "Deny",
"Principal" : "*",
"Action" : "s3:*",
"Resource" : [
"arn:aws:s3 :::MyExampleBucket",
"arn:aws:s3 :::MyExampleBucket/*"
],
"Condition" : {
"StringNotLike" : {
"aws:userId" : [
"AROAEXAMPLEID : *",
"111111111111"
]
}
}
}
]
} |
ÒÔϲßÂÔÏÔʾÁË¿ØÖÆÌ¨¼¶·ÃÎÊËùÐèµÄ·þÎñ²Ù×÷£¬ÀýÈçÓë¿ØÖÆÌ¨µÄ IAM Çл»½ÇÉ«¹¦ÄÜÅäºÏʹÓõIJÙ×÷¡£
{
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow",
"Principal" : {
"AWS": "arn :aws :iam: :111111111111
:role /ROLENAME"
},
"Action" : [
"s3: ListAllMyBuckets" ,
"s3: GetBucketLocation"
],
"Resource" : "*"
},
{
"Effect" : "Allow",
"Principal" : {
"AWS": "arn :aws:iam: :111111111111
:role /ROLENAME"
},
"Action" : "s3:ListBucket",
"Resource" : "arn:aws:s3: ::MyExampleBucket"
},
{
"Effect" : "Allow",
"Principal" : {
"AWS": "arn: aws: iam: :111111111111
:role /ROLENAME"
},
"Action" : [
"s3:GetObject ",
"s3:PutObject ",
"s3:DeleteObject "
],
"Resource" : "arn:aws:s3: ::MyExampleBucket
/*"
},
{
"Effect" : "Deny",
"Principal" : "*",
"Action": "s3 :*",
"Resource" : [
"arn:aws:s3 :::MyExampleBucket",
"arn:aws:s3 :::MyExampleBucket /*"
],
"Condition" : {
"StringNotLike" : {
"aws:userId" : [
"AROAEXAMPLEID: *",
"111111111111"
]
}
}
}
]
} |
ÒªÏòÆäËûÕË»§ÖÐµÄ IAM Óû§ÊÚÓè API/CLI ·ÃÎÊȨÏÞ£¬ÄúÐèÒª½«
IAM Óû§µÄ AIDAEXAMPLEID Ìí¼Óµ½¡°aws:userId¡±Ìõ¼þ£¬¾ÍÏñÎÒÃÇÉÏÒ»½ÚËù×öµÄÄÇÑù¡£³ýÁË¡°aws:userId¡±Ìõ¼þÖ®Í⣬Äú»¹ÐèÒª½«
IAM Óû§µÄÍêÕû ARN Ìí¼Óµ½ÕâЩ²ßÂ﵀ Principal ÔªËØ¡£Çë×¢Ò⣬Äú²»ÄÜÏò IAM Óû§ÊÚÓè¿çÕË»§¿ØÖÆÌ¨·ÃÎÊȨÏÞ£¬ÒòΪ¸ÃÓû§ÐèÒª¾ß±¸Ä¿±êÕË»§ÖеĽÇÉ«£¬µ«Äú¿ÉÒÔͨ¹ý
API/CLI ÊÚÓè¶Ô´æ´¢Í°µÄ·ÃÎÊȨÏÞ¡£¾ßÌåÈçÏÂËùʾ¡£
{
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow",
"Principal" : [
{ "AWS": [
"arn:aws:iam: :222222222222: role /ROLENAME",
"arn:aws:iam: :222222222222: user /USERNAME"
]
}
],
"Action": "s3 :ListBucket",
"Resource" : "arn:aws:s3:: :MyExampleBucket"
},
{
"Effect" : "Allow",
"Principal" : [
{
"AWS" : [
"arn:aws :iam::222222222222 :role /ROLENAME",
"arn:aws :iam::222222222222 :user /USERNAME"
]
}
],
"Action" : [
"s3:GetObject ",
"s3:PutObject",
"s3:DeleteObject "
],
"Resource": "arn:aws:s3: ::MyExampleBucket/
*"
},
{
"Effect" : "Deny",
"Principal" : "*",
"Action" : "s3 :*",
"Resource" : [
"arn:aws:s3:::MyExampleBucket",
"arn:aws:s3:::MyExampleBucket /*"
],
"Condition" : {
"StringNotLike" : {
"aws:userId" : [
"AROAEXAMPLEID :*",
"AIDAEXAMPLEID", "111111111111"
]
}
}
}
]
} |
³ýÁËÔڴ洢Ͱ²ßÂÔÖаüº¬½ÇɫȨÏÞÖ®Í⣬Äú»¹ÐèÒªÔÚ IAM Óû§»ò½ÇÉ«µÄÓû§²ßÂÔÖж¨ÒåÕâЩȨÏÞ¡£ÕâЩȨÏÞ¿ÉÒÔÌí¼Óµ½¿Í»§ÍйܵIJßÂÔ²¢¸½¼Óµ½
IAM ¿ØÖÆÌ¨ÖеĽÇÉ«»òÓû§£¬Ïê¼ûÒÔϲßÂÔÎĵµ¡£
{
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow",
"Action" : [
"s3: ListAllMyBuckets",
"s3 :GetBucketLocation"
],
"Resource" : "*"
},
{
"Effect" : "Allow",
"Action" : "s3:ListBucket",
"Resource" : "arn:aws:s3:::MyExampleBucket"
},
{
"Effect" : "Allow",
"Action" : [ "s3:GetObject",
"s3:PutObject", "s3:DeleteObject"
],
"Resource" : "arn:aws:s3:: :MyExampleBucket
/*"
}
]
} |
°´ÕÕ±¾ÎÄÖеÄÖ¸µ¼£¬¼´Ê¹Óû§ÓµÓÐ Admin ²ßÂÔ»ò´øÓÐ s3:* µÄ²ßÂÔ£¬Ò²¿ÉÒÔ½« S3 ´æ´¢Í°·ÃÎÊȨÏÞÏÞÓÚ±¾µØÕË»§ÄںͲ»Í¬ÕË»§ÖеÄÌØ¶¨
IAM ½ÇÉ«»òÓû§¡£ÕâÖÖÂß¼ÓжàÖÖÓ¦Ó㬸÷ÖÖʹÓð¸ÀýµÄÒªÇó¿ÉÄÜ»áÓÐËù²»Í¬¡£ÀýÈ磬Äú¿ÉÒÔʹÓô˷½·¨ÉèÖô洢Ͱ£¬ÒÔ¹©
Auto Scaling ×éÄÚµÄʵÀý·ÃÎÊ¡£ÈçͬÔÚ°üº¬¸öÈ˼ǼºÍÕË»§ÐÅÏ¢µÄ´æ´¢Í°ÖÐÒ»Ñù£¬Äú»¹¿ÉÒÔʹÓô˷½·¨ÏÞÖÆ¶Ô¾ßÓи߼¶±ð°²È«ÐèÇóµÄ´æ´¢Í°µÄ·ÃÎÊ¡£Îñ±ØÀμǣ¬×îºÃʼÖÕ½ö½«È¨ÏÞÊÚÓèÖ´ÐбØÒªÈÎÎñËùÐèµÄ×ÊÔ´¡£
|