如何赋予目标桶日志传递组写和READ_ACP权限？

Question

我试图设置一个cloudfront和s3桶与地形。当我运行terraform apply时，它将返回以下错误：

• aws_s3_bucket.app:放置S3日志时出错: InvalidTargetBucketForLogging:您必须将日志传递组写和READ_ACP权限授予目标桶

我的S3.tf文件：

data "aws_iam_policy_document" "s3_policy" {
  policy_id = "PolicyForCloudFrontPrivateContent"

  statement {
    sid       = "1"
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::${local.name_env}/*"]

    principals {
      type        = "AWS"
      identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
    }
  }
}

resource "aws_s3_bucket" "app" {
  bucket = "${local.name_env}"
  policy = "${data.aws_iam_policy_document.s3_policy.json}"

  logging {
    target_bucket = "${local.logs_bucket}"
    target_prefix = "app-${var.environment}"
  }

  versioning {
    enabled = true
  }

  tags = "${local.tags}"
}

Answer 1

您需要将一个acl属性添加到您的aws_s3_bucket中，其值为“日志传递-写入”。

resource "aws_s3_bucket" "app" {
  bucket = "${local.name_env}"
  acl = "log-delivery-write"
  ...
}

Answer 2

更新: terraform现在本机支持自定义桶acls。下面是对预定义acls不够的旧版本的解决方案。

下面是如何使用null资源和AWS通过terraform实现这一目标。

resource "aws_s3_bucket" "files_bucket" {
  # ...

  logging {
    target_bucket = "${aws_s3_bucket.logs_bucket.bucket}"
  }

  depends_on = [
    "null_resource.logs_bucket_acl_workaround"
  ]
}


resource "aws_s3_bucket" "logs_bucket" {
  # ...
  acl    = "private"
}


locals {
  put_bucket_acl_cmd = "s3api put-bucket-acl --bucket ${aws_s3_bucket.logs_bucket.bucket} --grant-write 'uri=\"http://acs.amazonaws.com/groups/s3/LogDelivery\"' --grant-read-acp 'uri=\"http://acs.amazonaws.com/groups/s3/LogDelivery\"'"
}

resource "null_resource" "logs_bucket_acl_workaround" {
  # cannot set bucket ACLs via terraform yet
  # https://github.com/terraform-providers/terraform-provider-aws/issues/989
  depends_on = [
    "aws_s3_bucket.logs_bucket",
  ]

  triggers = {
    bucket = "${aws_s3_bucket.logs_bucket.bucket}"
    command = "${local.put_bucket_acl_cmd}"
  }

  provisioner "local-exec" {
    command = "aws ${local.put_bucket_acl_cmd}"
  }
}

请注意，以这种方式添加的ACL只会被添加，而不会被删除。