Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Incorrect S3 bucket policy is detected for bucket in CloudFormation

I have issues implementing CloudTrail via Cloudformation, with a Incorrect S3 bucket policy is detected for bucket error being thrown when I try to launch the model.

Here is the configuration from the BucketPolicy:

"LogBucketPolicy": {
        "Type": "AWS::S3::BucketPolicy",
        "Properties": {
            "Bucket": {
                "Ref": "LogBucket"
            },
            "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Sid": "AWSCloudTrailAclCheck",
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "cloudtrail.amazonaws.com"
                        },
                        "Action": "s3:GetBucketAcl",
                        "Resource": {
                            "Fn::Join": [
                                "",
                                [
                                    "arn:aws:s3:::",
                                    {
                                        "Ref": "LogBucket"
                                    }
                                ]
                            ]
                        }
                    },
                    {
                        "Sid": "AWSCloudTrailWrite",
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "cloudtrail.amazonaws.com"
                        },
                        "Action": "s3:PutObject",
                        "Resource": {
                            "Fn::Join": [
                                "",
                                [
                                    "arn:aws:s3:::",
                                    {
                                        "Ref": "LogBucket"
                                    },
                                    "/AWSLogs/139339407673/*"
                                ]
                            ]
                        },
                        "Condition": {
                            "StringEquals": {
                                "s3:x-amz-acl": "bucket-owner-full-control"
                            }
                        }
                    }
                ]
            }
        }
    }

I have copied the template from AWS examples, but let me know if I did a mistake in the implementation.

Edit: The error is not thrown by the bucket policy, but by CloudTrail. Here is the configuration of the bucket:

"Trail": {
        "Type": "AWS::CloudTrail::Trail",
        "Properties": {
            "SnsTopicName": {
                "Fn::GetAtt": [
                    "Topic",
                    "TopicName"
                ]
            },
            "IsLogging": true,
            "S3BucketName": {
                "Ref": "LogBucket"
            }
        },
        "DependsOn": [
            "LogBucket"
        ]
    }
like image 989
Adrien Merlier Avatar asked Mar 06 '18 15:03

Adrien Merlier


People also ask

How do I fix an AWS S3 bucket policy and Public permissions access denied error?

If you're denied permissions, then use another IAM identity that has bucket access, and edit the bucket policy. Or, delete and recreate the bucket policy if no one has access to it. If you're trying to add a public read policy, then disable the bucket's S3 Block Public Access.

Why am I getting the error invalid principal in policy when I try to update my Amazon S3 bucket policy?

You receive the "Error: Invalid principal in policy" message when the value of a Principal in your bucket policy is not valid. To resolve this error, confirm the following: Your bucket policy uses supported values for a Principal element. The Principal value is formatted correctly.

What is Bucket policy in S3?

A bucket policy is a resource-based AWS Identity and Access Management (IAM) policy. You add a bucket policy to a bucket to grant other AWS accounts or IAM users access permissions for the bucket and the objects in it. Object permissions apply only to the objects that the bucket owner creates.

Why is my S3 Access Denied?

If you're getting Access Denied errors on public read requests that are allowed, check the bucket's Amazon S3 block public access settings. Review the S3 Block Public Access settings at both the account and bucket level. These settings can override permissions that allow public read access.


1 Answers

As Krishna has mentioned, the error came from the fact that I didn't put the dependence of the BucketPolicy. When this was done, the stack was deployed with no issues.

like image 175
Adrien Merlier Avatar answered Oct 08 '22 08:10

Adrien Merlier