0

我正在学习如何使用 terraform 自动化基础设施。目前我有一个应用程序负载均衡器，我希望将日志从它发送到 S3 存储桶。我创建了一个指定策略的 json 文件，但是当我尝试应用 terraform 代码时，出现以下错误：

应用 Terraform 代码时出错

我检查了我的 AWS 帐号，检查了我登录的用户的权限，但无法弄清楚为什么会发生这种情况。下面也是我的策略的代码以及 S3 存储桶的创建。任何建议将不胜感激。

政策

{
"Version": "2012-10-17",
"Id": "javahome-alb-policy",
"Statement": [
    {
        "Sid": "root-access",
        "Effect": "Allow",
        "Principle": {
            "Service": "arn:aws:iam::aws-account-id:root"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${access_logs_bucket}/AWSLogs/aws-account-id/*"
    },
    {
        "Sid": "log-delivery",
        "Effect": "Allow",
        "Principle": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${access_logs_bucket}/AWSLogs/aws-account-id/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    },
    {
        "Sid": "log-delivery-access-check",
        "Effect": "Allow",
        "Principle": {
            "Service": "delivery.logs.amazonaws.com"
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws:s3:::${access_logs_bucket}"
    }
]

}

S3 存储桶

resource "aws_s3_bucket" "alb_access_logs" {


bucket = var.alb_s3_logs
  policy = data.template_file.javahome.rendered
  acl    = "private"
  region = var.region
  tags = {
    Name        = "jalb-access-logs"
    Environment = terraform.workspace
  }
}

应用程序负载均衡器

resource "aws_lb_target_group" "javahome" {


name     = var.lb_tg_name
  port     = var.http_port
  protocol = "HTTP"
  vpc_id   = aws_vpc.my_app.id
}

resource "aws_lb_target_group_attachment" "javahome" {
  count            = var.web_ec2_count
  target_group_arn = aws_lb_target_group.javahome.arn
  target_id        = aws_instance.web.*.id[count.index]
  port             = var.http_port
}
resource "aws_lb" "javahome" {
  name               = var.alb_name
  internal           = false
  load_balancer_type = var.lb_type
  security_groups    = [aws_security_group.elb_sg.id]
  subnets            = local.pub_sub_ids

  access_logs {
    bucket  = aws_s3_bucket.alb_access_logs.bucket
    enabled = true
  }

  tags = {
    Environment = terraform.workspace
  }
}

resource "aws_lb_listener" "listener" {
  load_balancer_arn = aws_lb.javahome.arn
  port              = var.http_port
  protocol          = "HTTP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.javahome.arn
  }
}

data "template_file" "javahome" {
  template = file("scripts/iam/alb-s3-access-logs.json")
  vars = {
    access_logs_bucket = var.alb_s3_logs
  }
}
4

1 回答 1

0

这里的主要问题是拼写错误Principle，正确的语法是Principal. 此外，请查看日志来源的文档，这是由 AWS 直接管理的 AWS 账户。

这是来自 AWS Docs 的示例：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::aws-account-id:root"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/prefix/*"
    }
  ]
}

https://docs.aws.amazon.com/en_us/elasticloadbalancing/latest/application/load-balancer-access-logs.html

启用访问日志

当您为负载均衡器启用访问日志记录时，您必须指定负载均衡器将存储日志的 S3 存储桶的名称。存储桶必须与负载均衡器位于同一区域，并且必须具有授予 Elastic Load Balancing 将访问日志写入存储桶的权限的存储桶策略。存储桶可以由与拥有负载均衡器的账户不同的账户拥有。

PS 发布帐户 ID 不是一个好习惯。

于 2019-12-06T23:06:24.540 回答