Skip to content

(aws-cloudtrail): isOrganizationTrail attaches insufficient permissions to bucket #22267

@danilobuerger

Description

@danilobuerger

Describe the bug

When using a Trail with isOrganizationTrail: true, the bucket policy contains insufficient permissions and the stack creation fails with:

Invalid request provided: Incorrect S3 bucket policy is detected for bucket: ...

The Trail attaches the following permissions:

this.s3bucket.addToResourcePolicy(new iam.PolicyStatement({
resources: [this.s3bucket.bucketArn],
actions: ['s3:GetBucketAcl'],
principals: [cloudTrailPrincipal],
}));
this.s3bucket.addToResourcePolicy(new iam.PolicyStatement({
resources: [this.s3bucket.arnForObjects(
`${props.s3KeyPrefix ? `${props.s3KeyPrefix}/` : ''}AWSLogs/${Stack.of(this).account}/*`,
)],
actions: ['s3:PutObject'],
principals: [cloudTrailPrincipal],
conditions: {
StringEquals: { 's3:x-amz-acl': 'bucket-owner-full-control' },
},
}));

However, it is missing:

"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::myOrganizationBucket/AWSLogs/o-exampleorgid/*"

as described here: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html#org-trail-bucket-policy

Expected Behavior

It creates an organization trail.

Current Behavior

It fails with

Invalid request provided: Incorrect S3 bucket policy is detected for bucket: ...

Reproduction Steps

const bucket = new Bucket(this, "Bucket");
new Trail(this, 'Trail', { bucket, isOrganizationTrail: true });

Possible Solution

Adding the permission as outlined above.

Additional Information/Context

No response

CDK CLI Version

2.43.1

Framework Version

No response

Node.js Version

18.9.0

OS

macOS

Language

Typescript

Language Version

No response

Other information

No response

Metadata

Metadata

Assignees

Labels

@aws-cdk/aws-cloudtrailRelated to AWS CloudTrailbugThis issue is a bug.effort/smallSmall work item – less than a day of effortp1

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions