代码之家 › 专栏 › 技术社区 › Adrien Merlier

在CloudFormation中为bucket检测到错误的S3 bucket策略

amazon-cloudformation amazon-s3 amazon-web-services

Adrien Merlier · 技术社区 · 8 年前

我在通过Cloudformation实现CloudTrail时遇到问题,因为在尝试启动模型时抛出了一个错误的S3 bucket策略,所以检测到了错误的S3 bucket策略。

以下是BucketPolicy的配置:

"LogBucketPolicy": {
        "Type": "AWS::S3::BucketPolicy",
        "Properties": {
            "Bucket": {
                "Ref": "LogBucket"
            },
            "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Sid": "AWSCloudTrailAclCheck",
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "cloudtrail.amazonaws.com"
                        },
                        "Action": "s3:GetBucketAcl",
                        "Resource": {
                            "Fn::Join": [
                                "",
                                [
                                    "arn:aws:s3:::",
                                    {
                                        "Ref": "LogBucket"
                                    }
                                ]
                            ]
                        }
                    },
                    {
                        "Sid": "AWSCloudTrailWrite",
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "cloudtrail.amazonaws.com"
                        },
                        "Action": "s3:PutObject",
                        "Resource": {
                            "Fn::Join": [
                                "",
                                [
                                    "arn:aws:s3:::",
                                    {
                                        "Ref": "LogBucket"
                                    },
                                    "/AWSLogs/139339407673/*"
                                ]
                            ]
                        },
                        "Condition": {
                            "StringEquals": {
                                "s3:x-amz-acl": "bucket-owner-full-control"
                            }
                        }
                    }
                ]
            }
        }
    }

我已经从AWS示例中复制了模板,但如果我在实现中出错,请告诉我。

编辑:错误不是由bucket策略引发的,而是由CloudTrail引发的。以下是铲斗的配置:

"Trail": {
        "Type": "AWS::CloudTrail::Trail",
        "Properties": {
            "SnsTopicName": {
                "Fn::GetAtt": [
                    "Topic",
                    "TopicName"
                ]
            },
            "IsLogging": true,
            "S3BucketName": {
                "Ref": "LogBucket"
            }
        },
        "DependsOn": [
            "LogBucket"
        ]
    }

3 回复 | 直到 8 年前

Adrien Merlier 8 年前

正如克里希纳所提到的,错误来自于我没有把巴克特政策的依赖性放在一起的事实。完成此操作后,部署堆栈时没有出现任何问题。

Sudharsan Sivasankaran 8 年前

我修改了你的代码,它似乎对我有用。你能试试这个吗?

{
  "Parameters": {
    "LogBucket": {
      "Description": "Name Bucket.",
      "Type": "String"
    }
  },
  "Resources": {
    "LogBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
                "Ref": "LogBucket"
        },
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "AWSCloudTrailAclCheck",
              "Effect": "Allow",
              "Principal": {
                "Service": "cloudtrail.amazonaws.com"
              },
              "Action": "s3:GetBucketAcl",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:s3:::",
                    {
                      "Ref": "LogBucket"
                    }
                  ]
                ]
              }
            },
            {
              "Sid": "AWSCloudTrailWrite",
              "Effect": "Allow",
              "Principal": {
                "Service": "cloudtrail.amazonaws.com"
              },
              "Action": "s3:PutObject",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:s3:::",
                    {
                      "Ref": "LogBucket"
                    },
                    "/AWSLogs/139339407673/*"
                  ]
                ]
              },
              "Condition": {
                "StringEquals": {
                  "s3:x-amz-acl": "bucket-owner-full-control"
                }
              }
            }
          ]
        }
      }
    }
  }
}

Rotem jackoby 6 年前

除了公认的答案中提到的依赖性问题之外,错误还可能来自不同的S3策略配置错误的情况。

例如,如果我们查看以下策略:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck20131101",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::myBucketName"
    },
    {
      "Sid": "AWSCloudTrailWrite20131101",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::myBucketName/[optional] myLogFilePrefix/AWSLogs/<account-id>/*"
      "Condition": { 
        "StringEquals": { 
          "s3:x-amz-acl": "bucket-owner-full-control" 
        }
      }
    }
  ]
}

查看 Resource 第2条语句块:

 "Resource": "arn:aws:s3:::myBucketName/[optional] myLogFilePrefix/AWSLogs/<account-id>/*"

向资源块传递错误的值 例如错误的前缀(我的情况)或忘记 "*" 后缀(如前所述) here 在最后一个场景中) 可能导致错误 .

(*)示例摘自 here .