Terraform InvalidConfigurationRequest:拒绝对S3桶的访问

Question

我正在尝试将一些terraform代码部署到我有管理访问设置的AWS环境中。此代码的目的是将日志从应用程序负载均衡器发送到S3桶中。代码能够在没有问题的情况下创建存储桶，但是当涉及到日志记录部分时，我会遇到以下错误：

​

我很难克服这个错误。下面是我创建负载均衡器、S3桶的代码，以及我为日志记录所实现的策略。任何建议都会有帮助。提前谢谢。

S3桶

data "aws_elb_service_account" "javahome" {}

resource "aws_s3_bucket" "alb_access_logs" {
  bucket = var.alb_s3_logs
  acl    = "private"
  region = var.region
  tags = {
    Name        = "jalb-access-logs"
    Environment = terraform.workspace
  }
  policy = templatefile("${path.module}/scripts/iam/alb-s3-access-logs.json", {
    bucket_name = var.alb_s3_logs
    prefix      = var.prefix
    policy_arn  = data.aws_elb_service_account.javahome.arn
    }
  )
}

应用负载平衡器

resource "aws_lb" "javahome" {


name               = var.alb_name
  internal           = false
  load_balancer_type = var.lb_type
  security_groups    = [aws_security_group.elb_sg.id]
  subnets            = local.pub_sub_ids

  access_logs {
    bucket  = aws_s3_bucket.alb_access_logs.bucket
    prefix  = var.prefix
    enabled = true
  }

  tags = {
    Environment = terraform.workspace
  }
}

政策

{
"Version": "2012-10-17",
"Id": "javahome-alb-pilicy",
"Statement": [
    {
        "Sid": "root-access",
        "Effect": "Allow",
        "Principal": {
            "AWS": "${policy_arn}"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${bucket_name}/${prefix}/AWSLogs/*"
    },
    {
        "Sid": "log-delivery",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${bucket_name}/${prefix}/AWSLogs/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    },
    {
        "Sid": "log-delivery-access-check",
        "Effect": "Allow",
        "Principal": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws:s3:::${bucket_name}"
    }
]

}

Answer 1

我花了很长时间才弄明白这一点，但是S3桶对文档有两个要求：

存储桶必须位于负载balancer.

• Amazon S3托管加密密钥(SSE-S3)所需的同一区域。不支持其他加密选项。

来源：https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html

虽然它看起来像是错误消息的权限问题，但它实际上可能是具有错误加密类型的桶的问题。在我的例子中，问题是我的桶没有加密。

将存储桶更新为SSE-S3加密，我不再收到错误：

resource "aws_s3_bucket" "s3_access_logs_bucket" {
  bucket = var.access_logs_bucket_name
  acl = "private"
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }

  versioning {
    enabled = true
  }

}