通过 Terraform 启用 AWS Redshift 审计日志记录时出现 InsufficientS3BucketPolicyFault答案

【问题标题】：InsufficientS3BucketPolicyFault when enabling AWS Redshift audit logging through Terraform通过 Terraform 启用 AWS Redshift 审计日志记录时出现 InsufficientS3BucketPolicyFault
【发布时间】：2022-01-03 03:44:52
【问题描述】：

问题

我正在尝试在 AWS Redshift 集群上启用审计日志记录。我一直在遵循 AWS 提供的说明：https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging

当前配置

我已将相关的 IAM 角色定义如下

resource "aws_iam_role" "example-role" {
  name = "example-role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "redshift.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF

}

并已将以下 IAM 权限授予example-role 角色：

{
            "Sid": "AllowAccessForAuditLogging",
            "Effect": "Allow",

            "Action": [
                "s3:PutObject",
                "s3:GetBucketAcl"
            ],
            "Resource": [
                "arn:aws:s3:::example-bucket",
                "arn:aws:s3:::example-bucket/*"
            ]
        },

redshift集群配置相关部分如下：

resource "aws_redshift_cluster" "example-cluster-name" {
  cluster_identifier = "example-cluster-name"
  ...

  # redshift audit logging to S3
  logging {
    enable        = true
    bucket_name   = "example-bucket-name"
  }

  master_username           = var.master_username
  iam_roles                 = [aws_iam_role.example-role.arn]
  ...

错误

terraform plan 运行正常，并根据上述配置产生预期的计划。但是，在运行terraform apply 时会出现以下错误：

Error: error enabling Redshift Cluster (example-cluster-name) logging: InsufficientS3BucketPolicyFault: Cannot read ACLs of bucket example-bucket-name. Please ensure that your IAM permissions are set up correctly.

注意：我已将所有资源标识符替换为 example-* 资源名称和标识符。

【问题讨论】：

您需要将您的角色作为存储桶策略。可能您将其附加为 IAM 角色？
你是对的，做到了！谢谢！

标签： amazon-web-services terraform amazon-redshift amazon-iam terraform-provider-aws

【解决方案1】：

@shimo 的回答是正确的。我只是为像我这样的人详细说明

Redshift 可以完全访问 S3。但是您也需要添加存储桶策略。（S3的许可）

{
           "Sid": "Statement1",
           "Effect": "Allow",
           "Principal": {
               "AWS": "arn:aws:iam::361669875840:user/logs"
           },
           "Action": [
               "s3:GetBucketAcl",
               "s3:PutObject"
           ],
           "Resource": [
               "arn:aws:s3:::<your-bucket>",
               "arn:aws:s3:::<your-bucket>/*"
           ]
       }
 
- `361669875840` is match with your region check [here][1]


 [1]: https://github.com/finos/compliant-financial-infrastructure/blob/main/aws/redshift/redshift_template_public.yml

【讨论】：