[英]Pulumi - Creating S3 bucket policy for CloudTrail logs - Invalid resource
I am using Pulumi (Python) and trying to create a bucket for AWS CloudTrail logs.我正在使用 Pulumi (Python) 并尝试为 AWS CloudTrail 日志创建一个存储桶。 I based my code off this example.
我的代码基于这个例子。 I keep getting the following error:
Error putting S3 policy: MalformedPolicy: Policy has invalid resource
我不断收到以下错误消息:
Error putting S3 policy: MalformedPolicy: Policy has invalid resource
import pulumi
import pulumi_aws as aws
# create a bucket to store CloudTrail logs
cloudtrail_bucket = aws.s3.Bucket("CloudTrailLogs")
# assign policy to bucket
aws_account_id = aws.get_caller_identity().account_id
bucket_policy = aws.s3.BucketPolicy(
"CloudTrailLogsBucketPolicy",
bucket=cloudtrail_bucket.id,
policy=pulumi.Output.all(cloudtrail_bucket.id).apply(
lambda bucket_id: f"""{{
"Version": "2012-10-17",
"Statement": [
{{
"Sid": "AWSCloudTrailAclCheck20150319",
"Effect": "Allow",
"Principal": {{"Service": "cloudtrail.amazonaws.com"}},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::{bucket_id}"
}},
{{
"Sid": "AWSCloudTrailWrite20150319",
"Effect": "Allow",
"Principal": {{"Service": "cloudtrail.amazonaws.com"}},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::{bucket_id}/AWSLogs/{aws_account_id}/*",
"Condition": {{
"StringEquals": {{"s3:x-amz-acl": "bucket-owner-full-control"}}
}}
}}
]
}}
"""
),
)
Does anyone know what the issue could be?有谁知道问题可能是什么?
My current environment is using the following:我当前的环境正在使用以下内容:
pulumi==3.9.1
pulumi-aws==4.15.0
You're referencing the account ID without making it part of the apply/all statement.您在引用帐户 ID 时并未将其作为 apply/all 语句的一部分。
Try this instead:试试这个:
policy=pulumi.Output.all(cloudtrail_bucket.id, aws_account_id).apply(
lambda args: f"""{{
"Version": "2012-10-17",
"Statement": [
{{
"Sid": "AWSCloudTrailAclCheck20150319",
"Effect": "Allow",
"Principal": {{"Service": "cloudtrail.amazonaws.com"}},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::{args[0]}"
}},
{{
"Sid": "AWSCloudTrailWrite20150319",
"Effect": "Allow",
"Principal": {{"Service": "cloudtrail.amazonaws.com"}},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::{args[0]}/AWSLogs/{args[1]}/*",
"Condition": {{
"StringEquals": {{"s3:x-amz-acl": "bucket-owner-full-control"}}
}}
}}
]
}}
"""
)
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.