[英]CloudFormation CloudTrail S3 Policy Error - Incorrect S3 bucket policy is detected for bucket
Thanks in advance!提前致谢!
I've been stuck on this all weekend.. I'm attempting to create a cloudtrail service in cloudformation but receive this error when ran - Incorrect S3 bucket policy is detected for bucket: s3bucket-xxxxxx我整个周末都被困在这个问题上..我正在尝试在 cloudformation 中创建一个 cloudtrail 服务,但在运行时收到此错误 - 检测到存储桶的 S3 存储桶策略不正确:s3bucket-xxxxxx
Here's my code;这是我的代码;
"s3bucket-xxxxxx": {
"Type": "AWS::S3::Bucket",
"Properties": {
"AccessControl": "Private",
"VersioningConfiguration": {
"Status": "Suspended"
}
},
"Metadata": {
"AWS::CloudFormation::Designer": {
"id": "XXXX"
}
}
},
"s3policytraillogs": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "s3bucket-xxxxxx"
},
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSCloudTrailAclCheck20150319",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::s3bucket-xxxxxx"
},
{
"Sid": "AWSCloudTrailWrite20150319",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::s3bucket-xxxxxx/AWSLogs/XXXXXXXX/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
},
"Metadata": {
"AWS::CloudFormation::Designer": {
"id": "XXXX"
}
}
},
"trailtraillogs": {
"Type": "AWS::CloudTrail::Trail",
"Properties": {
"IncludeGlobalServiceEvents": true,
"IsLogging": "true",
"S3BucketName": {
"Ref": "s3bucket-xxxxxx"
}
},
"Metadata": {
"AWS::CloudFormation::Designer": {
"id": "XXXX"
}
}
}
To fix this the resource needed to be joined up to the bucket using a reference要解决此问题,需要使用引用将资源连接到存储桶
"Resource": [{
"Fn::Join": [ "", [
"arn:aws:s3:::", {
"Ref": "s3traillogs"
}, "/AWSLogs/XXXXXXXXXXX/*"
]
]
}],
The mentioned error can also comes due to:提到的错误也可能是由于:
1 ) Dependency issues between the trail and the bucket. 1) trail和bucket之间的依赖问题。
This can be solved by referencing to the bucket from the trail:这可以通过从跟踪中引用存储桶来解决:
"DependsOn": [
"TheLogBucket"
]
2 ) Bad configuration of the bucket policy. 2)桶策略配置错误。
For example, in the 2nd statement: "Resource":"arn:aws:s3:::myBucketName/<prefix>/AWSLogs/<account-id>/*"
例如,在第二条语句中: "Resource":"arn:aws:s3:::myBucketName/<prefix>/AWSLogs/<account-id>/*"
passing wrong prefix, account Id or forgetting the "*"
postfix.传递错误的前缀、帐户 ID 或忘记"*"
后缀。
3 ) Bad indentation or misplaced quotation marks in the YAML file. 3 ) YAML 文件中的错误缩进或错位的引号。
(*) Issues of #1 and #2 also mentioned here . (*) #1 和 #2 的问题也在这里提到。
(**) Please make sure you follow CloudTrail Trail Naming Requirements . (**) 请确保您遵循CloudTrail 路径命名要求。
Based on the Resource Definition, probably the YAML would be as:根据资源定义,YAML 可能是这样的:
EventBucketStorage:
Type: "AWS::S3::Bucket"
Properties:
#AccessControl: PublicRead
MetricsConfigurations:
- Id: EventBucketStorageMetrics
BucketName: !Sub "s3-event-step-bucket-storage-s"
EventBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref EventBucketStorage
PolicyDocument:
Version: 2012-10-17
Statement:
-
Sid: "AWSCloudTrailAclCheck20150319"
Effect: Allow
Principal:
Service: cloudtrail.amazonaws.com
Action: s3:GetBucketAcl
Resource: !Join
- ""
- - "arn:aws:s3:::"
- !Ref EventBucketStorage
-
Sid: AWSCloudTrailWrite20150319
Effect: Allow
Principal:
Service: cloudtrail.amazonaws.com
Action: s3:PutObject
Resource: !Join
- ""
- - "arn:aws:s3:::"
- !Ref EventBucketStorage
- /*
Condition:
StringEquals:
s3:x-amz-acl: bucket-owner-full-control
you can also check the link Start the execution of State Machine based on Amazon S3 Event您还可以检查链接Start the execution of State Machine based on Amazon S3 Event
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.