# 需要组织成员身份才能访问 VPC 资源

此 [VPC 端点策略](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html) 仅允许 `o-1abcde 123` 中的 AWS Identity and Access Management（IAM）主体和资源 Amazon Personalize（Amazon S3）终端。这种预防性控制有助于 建立信任区并界定个人数据边界。欲了解更多信息 关于本政策如何帮助保护您组织中的隐私和个人数据， 请参阅本指南中[的 AWS PrivateLink](https://docs.aws.amazon.com/prescriptive-guidance/latest/privacy-reference-architecture/personal-data-account.html#privatelink)。

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowOnlyIntendedResourcesAndPrincipals",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalOrgID": "o-1abcde123",
                    "aws:ResourceOrgID": "o-1abcde123"
                }
            }
        }
    ]
}
```
