如何配置 s3 存儲桶以允許 aws 應用程序負載均衡器（不是類）使用它？ 當前拋出“拒絕訪問”

Question

我有一個應用程序負載平衡器，我正在嘗試啟用日志記錄，terraform 代碼如下：

resource "aws_s3_bucket" "lb-logs" {
  bucket = "yeo-messaging-${var.environment}-lb-logs"
}

resource "aws_s3_bucket_acl" "lb-logs-acl" {
  bucket = aws_s3_bucket.lb-logs.id
  acl    = "private"
}


resource "aws_lb" "main" {
  name                       = "main"
  internal                   = false
  load_balancer_type         = "application"
  security_groups            = [aws_security_group.public.id]
  enable_deletion_protection = false
  subnets                    = [aws_subnet.public.id, aws_subnet.public-backup.id]

  access_logs {
    bucket  = aws_s3_bucket.lb-logs.bucket
    prefix  = "main-lb"
    enabled = true
  }
}

不幸的是，由於以下原因，我無法應用它：

Error: failure configuring LB attributes: InvalidConfigurationRequest: Access Denied for bucket: xxx-lb-logs. Please check S3bucket permission
│       status code: 400, request id: xx

我看過一些 SO 線程和文檔，但不幸的是，它們都適用於經典的負載均衡器，特別是允許您獲取 laod 均衡器的服務帳戶的“數據”。

我找到了一些關於如何將正確權限應用於 SA 的策略信息，但我似乎找不到如何將服務帳戶應用於 LB 本身。

例子：

data "aws_iam_policy_document" "allow-lb" {
  statement {
    principals {
      type        = "AWS"
      identifiers = [data.aws_elb_service_account.main.arn]
    }

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:PutObject"
    ]

    resources = [
      aws_s3_bucket.lb-logs.arn,
      "${aws_s3_bucket.lb-logs.arn}/*",
    ]
  }
}


resource "aws_s3_bucket_policy" "allow-lb" {
  bucket = aws_s3_bucket.lb-logs.id
  policy = data.aws_iam_policy_document.allow-lb.json
}

但這一切都沒有實際意義，因為data.aws_elb_service_account.main.arn僅適用於經典 LB。

---

編輯：

完整代碼嘗試來自以下答案：

resource "aws_s3_bucket" "lb-logs" {
  bucket = "yeo-messaging-${var.environment}-lb-logs"
}

resource "aws_s3_bucket_acl" "lb-logs-acl" {
  bucket = aws_s3_bucket.lb-logs.id
  acl    = "private"
}

data "aws_iam_policy_document" "allow-lb" {
  statement {
    principals {
      type        = "Service"
      identifiers = ["logdelivery.elb.amazonaws.com"]
    }

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "${aws_s3_bucket.lb-logs.arn}/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"

      values = [
        "bucket-owner-full-control"
      ]
    }
  }
}

resource "aws_s3_bucket_policy" "allow-lb" {
  bucket = aws_s3_bucket.lb-logs.id
  policy = data.aws_iam_policy_document.allow-lb.json
}


resource "aws_lb" "main" {
  name                       = "main"
  internal                   = false
  load_balancer_type         = "application"
  security_groups            = [aws_security_group.public.id]
  enable_deletion_protection = false
  subnets                    = [aws_subnet.public.id, aws_subnet.public-backup.id]

  access_logs {
    bucket  = aws_s3_bucket.lb-logs.bucket
    prefix  = "main-lb"
    enabled = true
  }
}

Answer 1

您需要使用的存儲桶策略在 Application Load Balancers 上訪問日志的官方文檔中提供。

{
    "Effect": "Allow",
    "Principal": {
        "Service": "logdelivery.elb.amazonaws.com"
    },
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::bucket-name/prefix/AWSLogs/your-aws-account-id/*",
    "Condition": {
        "StringEquals": {
            "s3:x-amz-acl": "bucket-owner-full-control"
        }
    }
}

請注意， bucket-name prefix和your-aws-account-id需要在該策略中替換為您的實際值。

---

在 Terraform 中：

data "aws_iam_policy_document" "allow-lb" {
  statement {
    principals {
      type        = "Service"
      identifiers = ["logdelivery.elb.amazonaws.com"]
    }

    actions = [
      "s3:PutObject"
    ]

    resources = [
      "${aws_s3_bucket.lb-logs.arn}/*"
    ]

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"

      values = [
        "bucket-owner-full-control"
      ]
    }
  }
}