通过Terraform启用AWS Redshift审计日志记录时出现不足S3BucketPolicyFault

Question

问题

我正在尝试在AWS红移集群上启用审计日志记录。我一直在遵循AWS提供的说明：https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-审核启用日志记录

当前配置

我已将相关IAM角色定义如下

resource "aws_iam_role" "example-role" {
name = "example-role"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "redshift.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
EOF
}

并已将以下IAM权限授予example-role角色：

{
"Sid": "AllowAccessForAuditLogging",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetBucketAcl"
],
"Resource": [
"arn:aws:s3:::example-bucket",
"arn:aws:s3:::example-bucket/*"
]
},

红移集群配置的相关部分如下：

resource "aws_redshift_cluster" "example-cluster-name" {
cluster_identifier = "example-cluster-name"
...
# redshift audit logging to S3
logging {
enable        = true
bucket_name   = "example-bucket-name"
}
master_username           = var.master_username
iam_roles                 = [aws_iam_role.example-role.arn]
...

错误

terraform plan正确运行，并根据上述配置生成预期计划。但是，当运行terraform apply时，会出现以下错误：

Error: error enabling Redshift Cluster (example-cluster-name) logging: InsufficientS3BucketPolicyFault: Cannot read ACLs of bucket example-bucket-name. Please ensure that your IAM permissions are set up correctly.

注意：我已经用示例-*资源名称和标识符替换了所有资源标识符。

Answer 1

@shimo的回答是正确的。我只是为像我这样的人详细介绍

• Redshift可以完全访问S3。但你也需要增加水桶政策。(S3许可(

{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::361669875840:user/logs"
},
"Action": [
"s3:GetBucketAcl",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::<your-bucket>",
"arn:aws:s3:::<your-bucket>/*"
]
}

- `361669875840` is match with your region check [here][1]

[1]: https://github.com/finos/compliant-financial-infrastructure/blob/main/aws/redshift/redshift_template_public.yml