amazon-web-services - IAM & 跨账户写入 S3 存储桶 : Allow service principal based on organisation ID

Question

我有很多 AWS 账户。我为所有这些日志启用了 VPC 流日志，并且我希望将这些日志发送到我的日志存档帐户中的中央 S3 存储桶。

有效的 IAM 策略如下:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AWSLogDeliveryWrite",
        "Effect": "Allow",
        "Principal": {"Service": "delivery.logs.amazonaws.com"},
        "Action": "s3:PutObject",],
        "Resource": "arn:aws:s3:::central_log_archive_bucket",
        "Condition": {
            "StringEquals": {
                "aws:SourceAccount": <account_id-1>,
                "aws:SourceAccount": <account_id-2>,
                "aws:SourceAccount": <account_id-3>,
                ...
                "aws:SourceAccount": <account_id-N>
            },
            "ArnLike": {
                "aws:SourceArn": "arn:aws:logs:*:<account_id-1>:*",
                "aws:SourceArn": "arn:aws:logs:*:<account_id-2>:*",
                "aws:SourceArn": "arn:aws:logs:*:<account_id-3>:*",
                ...
                "aws:SourceArn": "arn:aws:logs:*:<account_id-N>:*",

            }
        }
    }
  ]
}

我想简化这个。我不想像上面那样添加所有帐户 ID，而是希望允许属于我的组织下的 AWS 帐户中的任何 VPC 服务将日志发布到 S3。简而言之，我想做这样的事情:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AWSLogDeliveryWrite",
        "Effect": "Allow",
        "Principal": {"Service": "delivery.logs.amazonaws.com"},
        "Action": "s3:PutObject",],
        "Resource": "arn:aws:s3:::central_log_archive_bucket",
        "Condition": {
         "StringEquals": {
          "aws:PrincipalOrgID": "ID"
         }
        }
    }
  ]
}

但我看到以下错误消息:

服务主体的条件键不受支持

知道如何实现这个功能吗？

Answer 1

正如这里提到的https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html ,

您不能将某些条件键与某些服务主体一起使用。例如，您不能将 aws:PrincipalOrgID 条件键与服务主体 cloudfront.amazonaws.com. 或其他服务(例如日志)一起使用。您应该删除Principal 元素中不适用于服务主体的条件键。

您可以在每个帐户创建中使用 lambda 使其自动化，例如更改存储桶策略...