Describe the bug
When using a Trail with isOrganizationTrail: true, the bucket policy contains insufficient permissions and the stack creation fails with:
Invalid request provided: Incorrect S3 bucket policy is detected for bucket: ...
The Trail attaches the following permissions:
|
this.s3bucket.addToResourcePolicy(new iam.PolicyStatement({ |
|
resources: [this.s3bucket.bucketArn], |
|
actions: ['s3:GetBucketAcl'], |
|
principals: [cloudTrailPrincipal], |
|
})); |
|
|
|
this.s3bucket.addToResourcePolicy(new iam.PolicyStatement({ |
|
resources: [this.s3bucket.arnForObjects( |
|
`${props.s3KeyPrefix ? `${props.s3KeyPrefix}/` : ''}AWSLogs/${Stack.of(this).account}/*`, |
|
)], |
|
actions: ['s3:PutObject'], |
|
principals: [cloudTrailPrincipal], |
|
conditions: { |
|
StringEquals: { 's3:x-amz-acl': 'bucket-owner-full-control' }, |
|
}, |
|
})); |
However, it is missing:
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::myOrganizationBucket/AWSLogs/o-exampleorgid/*"
as described here: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html#org-trail-bucket-policy
Expected Behavior
It creates an organization trail.
Current Behavior
It fails with
Invalid request provided: Incorrect S3 bucket policy is detected for bucket: ...
Reproduction Steps
const bucket = new Bucket(this, "Bucket");
new Trail(this, 'Trail', { bucket, isOrganizationTrail: true });
Possible Solution
Adding the permission as outlined above.
Additional Information/Context
No response
CDK CLI Version
2.43.1
Framework Version
No response
Node.js Version
18.9.0
OS
macOS
Language
Typescript
Language Version
No response
Other information
No response
Describe the bug
When using a Trail with
isOrganizationTrail: true, the bucket policy contains insufficient permissions and the stack creation fails with:The Trail attaches the following permissions:
aws-cdk/packages/@aws-cdk/aws-cloudtrail/lib/cloudtrail.ts
Lines 226 to 241 in c425e8c
However, it is missing:
as described here: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html#org-trail-bucket-policy
Expected Behavior
It creates an organization trail.
Current Behavior
It fails with
Reproduction Steps
Possible Solution
Adding the permission as outlined above.
Additional Information/Context
No response
CDK CLI Version
2.43.1
Framework Version
No response
Node.js Version
18.9.0
OS
macOS
Language
Typescript
Language Version
No response
Other information
No response