amazon-web-services - Terraform ELB access_log S3 访问权限问题

Question

当我尝试为我的 elb access_log 创建 s3 存储桶时遇到 terraform 问题，我收到以下错误:

Error applying plan:

1 error(s) occurred:

* module.elb-author-dev.aws_elb.elb: 1 error(s) occurred:

* aws_elb.elb: Failure configuring ELB attributes: InvalidConfigurationRequest: Access Denied for bucket: my-elb-access-log. Please check S3bucket permission
status code: 409, request id: 13c63697-c016-11e7-8978-67fad50955bd

但是，如果我去 AWS 控制台并手动将权限授予我的 s3 公开访问权限给所有人。重新运行 terraform apply 它工作正常，请帮我解决这个问题。

我的 main.tf 文件

module "s3-access-logs" {
  source = "../../../../modules/aws/s3"

  s3_bucket_name       = "my-elb-access-data"
  s3_bucket_acl        = "private"
  s3_bucket_versioning = true
  s3_bucket_region = "us-east-2"
}
 # elastic load balancers (elb)
module "elb-author-dev" {
  source           = "../../../../modules/aws/elb"
  elb_sgs          = "${module.secgrp-elb-nonprod-
author.security_group_id}"
  subnets          = ["subnet-a7ec0cea"]
  application_tier    = "auth"
  access_logs_enabled = true
  access_logs_bucket  = "my-elb-access-log"  
  access_logs_prefix  = "dev-auth-elb-access-log" 
 access_logs_interval = "5"
 instances           = ["${module.ec2-author-dev.ec2_instance[0]}"]
}

我的 s3/main.tf

  resource "aws_s3_bucket" "s3_data_bucket" {
    bucket = "${var.s3_bucket_name}"
    acl    = "${var.s3_bucket_acl}" #"public"

    region = "${var.s3_bucket_region}"

   policy = <<EOF
  {
   "Id": "Policy1509573454872",
   "Version": "2012-10-17",
   "Statement": [
   {
      "Sid": "Stmt1509573447773",
      "Action": "s3:PutObject",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::my-elb-access-log/dev-auth-elb/AWSLogs/my_account_id/*",
      "Principal": {
      "AWS": [
          "033677994240"
        ]
      }
    }
  ]
}
EOF

  versioning {
    enabled = "${var.s3_bucket_versioning}" #true
  }
  tags {
    Name        = "${var.s3_bucket_name}"
    Terraform   = "${var.terraform_tag}"
 }
}

我的 elb.main.tf

  access_logs {
    enabled       = "${var.access_logs_enabled}"  #false
    bucket        = "${var.access_logs_bucket}"
    bucket_prefix = "${var.environment_name}-${var.application_tier}-${var.access_logs_prefix}"
    interval      = "${var.access_logs_interval}"  #60
  }

Answer 1

AWS 存储桶权限

您需要授予对 ELB 主体的访问权限。每个地区都有不同的校长。

Region, ELB Account Principal ID

us-east-1, 127311923021

us-east-2, 033677994240

us-west-1, 027434742980

us-west-2, 797873946194

ca-central-1, 985666609251

eu-west-1, 156460612806

eu-central-1, 054676820928

eu-west-2, 652711504416

ap-northeast-1, 582318560864

ap-northeast-2, 600734575887

ap-southeast-1, 114774131450

ap-southeast-2, 783225319266

ap-south-1, 718504428378

sa-east-1, 507241528517

us-gov-west-1*, 048591011584

cn-north-1*, 638102146993

* 这些地区需要单独的帐户。

来源: AWS access logging bucket permissions

地形

在 terraform 中，您的资源配置应如下例所示。您将需要上表中的 aws 帐户 ID 和主体 ID:

resource "aws_s3_bucket" "s3_data_bucket" {
    bucket = "${var.s3_bucket_name}"
    acl    = "${var.s3_bucket_acl}"
    region = "${var.s3_bucket_region}"

    policy =<<EOF
{
"Id": "Policy1509573454872",
"Version": "2012-10-17",
"Statement": [
    {
    "Sid": "Stmt1509573447773",
    "Action": "s3:PutObject",
    "Effect": "Allow",
    "Resource": "arn:aws:s3:::my-elb-access-data/dev-auth-elb/AWSLogs/your-account-id/*",
    "Principal": {
        "AWS": ["principal_id_from_table_above"]
    }
    }
]
}
EOF
}

您可能需要单独拆分策略，而不是像上面那样保持内联。在这种情况下，您需要像这样添加存储桶策略资源:

resource "aws_s3_bucket_policy" "elb_access_logs" {
  bucket = "${aws_s3_bucket.s3_data_bucket.id}"
  policy =<<EOF
{
"Id": "Policy1509573454872",
"Version": "2012-10-17",
"Statement": [
    {
    "Sid": "Stmt1509573447773",
    "Action": "s3:PutObject",
    "Effect": "Allow",
    "Resource": "arn:aws:s3:::my-elb-access-data/dev-auth-elb/AWSLogs/your-account-id/*",
    "Principal": {
        "AWS": ["principal_id_from_table_above"]
    }
    }
]
}
EOF
}