如何修复Terraform中CloudTrail的InsufficientS3BucketPolicyException错误

你遇到的错误核心是S3桶策略的资源路径与CloudTrail配置的s3_key_prefix不匹配，导致CloudTrail没有权限写入指定的日志路径。

问题根源 #

你的CloudTrail资源设置了s3_key_prefix = "cloudtrail-logs"，意味着日志会被写入S3桶的cloudtrail-logs/AWSLogs/{账户ID}/路径下，但当前桶策略存在两个关键问题：

• s3:PutObject的资源路径仅覆盖了根目录下的AWSLogs/{账户ID}/*，未包含cloudtrail-logs前缀，CloudTrail无法写入实际路径
• s3:ListBucket的Condition前缀也未包含cloudtrail-logs，导致CloudTrail无法遍历正确的日志目录

修正方案 #

调整S3桶策略的资源路径，将CloudTrail的s3_key_prefix纳入权限范围：

# Create S3 bucket policy allowing CloudTrail to write logs
resource "aws_s3_bucket_policy" "s3_log_bucket_policy" {
  bucket = aws_s3_bucket.s3_cloudtrail.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action   = "s3:PutObject"
        # 包含s3_key_prefix路径
        Resource = "${aws_s3_bucket.s3_cloudtrail.arn}/${var.cloudtrail_key_prefix}/AWSLogs/${data.aws_caller_identity.current.account_id}/*"
        Condition = {
          StringEquals = {
            "s3:x-amz-acl" = "bucket-owner-full-control"
          }
        }
      },
      {
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action   = "s3:GetBucketAcl"
        Resource = "${aws_s3_bucket.s3_cloudtrail.arn}"
      },
      {
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action   = "s3:ListBucket"
        Resource = "${aws_s3_bucket.s3_cloudtrail.arn}"
        Condition = {
          StringLike = {
            # 同样包含s3_key_prefix
            "s3:prefix" = ["${var.cloudtrail_key_prefix}/AWSLogs/${data.aws_caller_identity.current.account_id}/*"]
          }
        }
      }
    ]
  })
}

额外验证项 #

1. 确保var.cloudtrail_key_prefix的值与CloudTrail资源中的s3_key_prefix完全一致（当前为cloudtrail-logs）
2. 若启用了KMS加密，确认KMS密钥策略允许cloudtrail.amazonaws.com调用kms:GenerateDataKey和kms:Decrypt操作
3. 检查S3桶是否开启了版本控制或其他可能影响权限的配置

内容的提问来源于stack exchange，提问作者Nithil04