使用Terraform创建组织级CloudTrail遇S3存储桶策略错误求助

你遇到的InsufficientS3BucketPolicyException错误主要由三个原因导致：

1. CloudTrail ARN格式错误 #

你在桶策略的Condition中错误拼接了CloudTrail的ARN：${aws_cloudtrail.cloudtrail.arn}/${aws_cloudtrail.cloudtrail.name}，但CloudTrail的标准ARN格式为arn:aws:cloudtrail:区域ID:账户ID:trail/跟踪名称，不需要额外拼接跟踪名称。

2. 大小写不一致的Condition键 #

部分语句中使用了大写的AWS:SourceArn，但AWS策略的条件键区分大小写，正确写法应为小写的aws:SourceArn。

3. 循环依赖问题 #

桶策略引用了未创建的CloudTrail资源ARN，导致Terraform无法正确处理资源创建顺序，进而引发策略校验失败。

修正后的完整代码 #

1. 添加区域数据源（用于构造正确的CloudTrail ARN） #

data "aws_region" "current" {}

2. 修正S3桶策略 #

# Bucket policy for CloudTrail logging
resource "aws_s3_bucket_policy" "cloudtrail_bucket_policy" {
  bucket = aws_s3_bucket.cloudtrail_bucket.id

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "AWSCloudTrailAclCheck",
        "Effect": "Allow",
        "Principal": {
          "Service": "cloudtrail.amazonaws.com"
        },
        "Action": "s3:GetBucketAcl",
        "Resource": aws_s3_bucket.cloudtrail_bucket.arn,
        "Condition": {
          "StringEquals": {
            "aws:SourceArn": "arn:aws:cloudtrail:${data.aws_region.current.name}:${var.account_id}:trail/${var.organization_name}-organizational-Trail"
          }
        }
      },
      {
        "Sid": "AWSCloudTrailWrite",
        "Effect": "Allow",
        "Principal": {
          "Service": "cloudtrail.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": "${aws_s3_bucket.cloudtrail_bucket.arn}/AWSLogs/${var.account_id}/*",
        "Condition": {
          "StringEquals": {
            "aws:SourceArn": "arn:aws:cloudtrail:${data.aws_region.current.name}:${var.account_id}:trail/${var.organization_name}-organizational-Trail",
            "s3:x-amz-acl": "bucket-owner-full-control"
          }
        }
      },
      {
        "Sid": "AWSCloudTrailOrganizationWrite",
        "Effect": "Allow",
        "Principal": {
          "Service": "cloudtrail.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": "${aws_s3_bucket.cloudtrail_bucket.arn}/AWSLogs/${var.organization_id}/*",
        "Condition": {
          "StringEquals": {
            "aws:SourceArn": "arn:aws:cloudtrail:${data.aws_region.current.name}:${var.account_id}:trail/${var.organization_name}-organizational-Trail",
            "s3:x-amz-acl": "bucket-owner-full-control"
          }
        }
      }
    ]
  })
}

3. CloudTrail资源（无需修改，但需确保执行顺序） #

CloudTrail资源会自动依赖桶策略（因为桶策略已提前构造好ARN，无循环依赖），原代码可保留：

# CloudTrail resource
resource "aws_cloudtrail" "cloudtrail" {
  name                          = "${var.organization_name}-organizational-Trail"
  s3_bucket_name                = aws_s3_bucket.cloudtrail_bucket.id
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  is_organization_trail         = true

  event_selector {
    read_write_type           = "WriteOnly"
    include_management_events = true
  }
}

额外检查项 #

• 确保执行Terraform的IAM身份具备组织管理账户权限（因为创建组织级Trail需要管理账户权限）
• 确认var.organization_id、var.account_id、var.organization_name变量值正确无误

内容的提问来源于stack exchange，提问作者nikitag