Question

我正在学习如何使用terraform自动化基础架构。当前，我有一个应用程序负载平衡器，我希望将日志从该负载平衡器发送到S3存储桶中。我创建了一个指定策略的json文件，但是当我尝试应用terraform代码时，出现以下错误：

我已经检查了我的AWS帐号，检查了我登录用户的权限，但无法确定为什么会这样。以下是我的策略以及S3存储桶创建的代码。任何建议将不胜感激。

政策

{
"Version": "2012-10-17",
"Id": "javahome-alb-policy",
"Statement": [
    {
        "Sid": "root-access",
        "Effect": "Allow",
        "Principle": {
            "Service": "arn:aws:iam::aws-account-id:root"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${access_logs_bucket}/AWSLogs/aws-account-id/*"
    },
    {
        "Sid": "log-delivery",
        "Effect": "Allow",
        "Principle": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${access_logs_bucket}/AWSLogs/aws-account-id/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    },
    {
        "Sid": "log-delivery-access-check",
        "Effect": "Allow",
        "Principle": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws:s3:::${access_logs_bucket}"
    }
]

}

S3桶

resource "aws_s3_bucket" "alb_access_logs" {


bucket = var.alb_s3_logs
  policy = data.template_file.javahome.rendered
  acl    = "private"
  region = var.region
  tags = {
    Name        = "jalb-access-logs"
    Environment = terraform.workspace
  }
}

应用程序负载平衡器

resource "aws_lb_target_group" "javahome" {


name     = var.lb_tg_name
  port     = var.http_port
  protocol = "HTTP"
  vpc_id   = aws_vpc.my_app.id
}

resource "aws_lb_target_group_attachment" "javahome" {
  count            = var.web_ec2_count
  target_group_arn = aws_lb_target_group.javahome.arn
  target_id        = aws_instance.web.*.id[count.index]
  port             = var.http_port
}
resource "aws_lb" "javahome" {
  name               = var.alb_name
  internal           = false
  load_balancer_type = var.lb_type
  security_groups    = [aws_security_group.elb_sg.id]
  subnets            = local.pub_sub_ids

  access_logs {
    bucket  = aws_s3_bucket.alb_access_logs.bucket
    enabled = true
  }

  tags = {
    Environment = terraform.workspace
  }
}

resource "aws_lb_listener" "listener" {
  load_balancer_arn = aws_lb.javahome.arn
  port              = var.http_port
  protocol          = "HTTP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.javahome.arn
  }
}

data "template_file" "javahome" {
  template = file("scripts/iam/alb-s3-access-logs.json")
  vars = {
    access_logs_bucket = var.alb_s3_logs
  }
}

Answer 1

这里的主要问题是拼写错误的Principle，正确的语法是Principal。另外，请查看文档以获取日志源，该日志源是由AWS直接管理的AWS帐户。

以下是AWS Docs中的示例：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::aws-account-id:root"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/prefix/*"
    }
  ]
}

https://docs.aws.amazon.com/en_us/elasticloadbalancing/latest/application/load-balancer-access-logs.html

启用访问日志

为负载均衡器启用访问日志记录时，必须指定负载均衡器将在其中存储日志的S3存储桶的名称。存储桶必须与负载均衡器位于同一区域，并且必须具有存储桶策略，该策略授予Elastic Load Balancing权限以将访问日志写入存储桶。存储桶可以由拥有负载均衡器的帐户以外的其他帐户拥有。

P.S。发布帐户ID不是一个好习惯。

存储桶策略Terraform AWS中的未知原理

1 个答案: