aws-cloudformation - 使用正确的策略设置 Cloudtrail s3 存储桶

Question

我正在尝试让 Cloudtrail 上路，并希望设置 Cloudtrail s3bucket。但政策尚未完成。这是我的代码:

CloudtrailBucket:
  Type: AWS::S3::Bucket
  DeletionPolicy: Delete
  Description: Stores all Trails for this account
  Properties:
  AccessControl: BucketOwnerFullControl
  BucketName: !Sub "${AWS::AccountId}-invoice-cloudtrail"
  LifecycleConfiguration:
    Rules:
    - Id: GlacierRule
      Prefix: glacier
      Status: Enabled
      ExpirationInDays: '365'
      Transitions:
        - TransitionInDays: '1'
          StorageClass: Glacier
  BucketEncryption:
    ServerSideEncryptionConfiguration:
      - ServerSideEncryptionByDefault:
          SSEAlgorithm: AES256
  Tags:
    - Key: Name
      Value: !Sub '${EnvironmentName} ${Project}-CloudtrailBucket'
  VersioningConfiguration:
    Status: Suspended

这是我想要使用的政策:

CloudtrailBucketPolicy:
 Type: AWS::S3::BucketPolicy
 Properties:
  Bucket: !Ref CloudtrailBucket
  PolicyDocument:
    Statement:
    - Sid: AWSCloudTrailAclCheck
      Effect: Allow
      Principal:
        Service: cloudtrail.amazonaws.com
      Action:
        - s3:GetBucket*
      Resource:
       - !Sub "arn:aws:s3:::${AWS::AccountId}-invoice-cloudtrail/*"
    - Sid: AWSCloudTrailWrite
      Effect: Allow
      Principal:
        Service: cloudtrail.amazonaws.com
      Action: s3:PutObject
      Resource:
         - !Sub "arn:aws:s3:::${AWS::AccountId}-invoice-cloudtrail/*"
      Condition:
        StringEquals:
          s3:x-amz-acl: bucket-owner-full-control

我真的不知道出了什么问题。错误信息如下:

Action does not apply to any resource(s) in statement (Service: Amazon S3; Status Code: 400; Error Code: MalformedPolicy; Request ID: 7A458D04A5765AC6; S3 Extended Request ID: EYn2is5Oph1+pnZ0u+zEH067fWwD0fyq1+MRGRxJ1qT3WK+e1LFjhhE9fTLOFiBnhSzbItfdrz0=)

Answer 1

我认为您必须更改您的政策以符合以下要求:

CloudtrailBucketPolicy:
 Type: 'AWS::S3::BucketPolicy'
 Properties:
  Bucket: !Ref CloudtrailBucket
  PolicyDocument:
    Statement:
    - Sid: AWSCloudTrailAclCheck
      Effect: Allow
      Principal:
        Service: cloudtrail.amazonaws.com
      Action:
        - s3:GetBucketAcl
      Resource:
       - !Sub "arn:aws:s3:::${AWS::AccountId}-invoice-cloudtrail"
    - Sid: AWSCloudTrailWrite
      Effect: Allow
      Principal:
        Service: cloudtrail.amazonaws.com
      Action: s3:PutObject
      Resource:
         - !Sub "arn:aws:s3:::${AWS::AccountId}-invoice-cloudtrail/*"
      Condition:
        StringEquals:
          s3:x-amz-acl: bucket-owner-full-control

原因是 s3:GetBucket* 扩展为 s3:GetBucketAcl、s3:GetBucketCORS 等 ( all here )，所有其中期望存储桶作为资源，并且您在原始策略上提供了许多对象。因此，我更改了资源(删除了 /*)，并稍微清理了策略，因为 CloudTrail 应该只需要 s3:GetBucketAcl。