SonarQube阻止配置S3存储桶日志策略问题排查

问题背景 #

我正尝试将S3存储桶用于存储访问日志，使用Terraform部署的初始策略代码如下：

resource "aws_s3_bucket_policy" "bucket_logging_policy" {
  bucket = aws_s3_bucket.s3_access_logs_bucket.id
  policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Principal" : {
          "Service" : "logging.s3.amazonaws.com"
        },
        "Action" : "s3:PutObject",
        "Resource" : "arn:aws:s3:::${aws_s3_bucket.s3_access_logs_bucket.id}/*"
      }
    ]
  })
}

构建时SonarQube抛出以下错误：

• "Effect" : "Allow" -> 应拒绝不符合要求的请求；
• "Action" : "s3:PutObject" -> 所有S3操作应受限。

我尝试按照SonarQube和AWS的通用建议修改策略，但仍未解决问题，修改后的代码如下：

resource "aws_s3_bucket_policy" "bucket_logging_policy" {
  bucket = aws_s3_bucket.s3_access_logs_bucket.id
 
  policy = jsonencode({
    "Version" = "2012-10-17",
    "Statement" = [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "logging.s3.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${aws_s3_bucket.s3_access_logs_bucket.id}/*"
      },
      {
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::${aws_s3_bucket.s3_access_logs_bucket.id}/*",
        "Condition": {
          "Bool": {
            "aws:SecureTransport": "false"
          }
        }
      }
    ]
  })
}

合规调整方案 #

SonarQube的提示核心是最小权限原则和默认拒绝+显式允许的安全范式，同时要求所有操作必须有明确的约束条件。以下是符合要求的调整方案：

修正后的Terraform代码 #

resource "aws_s3_bucket_policy" "bucket_logging_policy" {
  bucket = aws_s3_bucket.s3_access_logs_bucket.id

  policy = jsonencode({
    "Version" = "2012-10-17",
    "Statement" = [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "logging.s3.amazonaws.com"
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::${aws_s3_bucket.s3_access_logs_bucket.id}/*",
        "Condition": {
          "Bool": {
            "aws:SecureTransport": "true"
          },
          "StringEquals": {
            "s3:x-amz-acl": "bucket-owner-full-control"
          }
        }
      },
      {
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": [
          "arn:aws:s3:::${aws_s3_bucket.s3_access_logs_bucket.id}",
          "arn:aws:s3:::${aws_s3_bucket.s3_access_logs_bucket.id}/*"
        ],
        "Condition": {
          "Bool": {
            "aws:SecureTransport": "false"
          }
        }
      },
      {
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": [
          "arn:aws:s3:::${aws_s3_bucket.s3_access_logs_bucket.id}",
          "arn:aws:s3:::${aws_s3_bucket.s3_access_logs_bucket.id}/*"
        ],
        "NotPrincipal": {
          "Service": "logging.s3.amazonaws.com"
        }
      }
    ]
  })
}

关键调整说明 #

1. 给允许操作添加约束条件：在Allow语句中加入aws:SecureTransport": "true"，强制日志服务通过HTTPS写入；同时添加s3:x-amz-acl条件，确保日志文件的权限归桶所有者所有，符合AWS最佳实践。
2. 覆盖完整资源范围：Deny语句同时包含桶本身（arn:aws:s3:::bucket-name）和桶内对象（arn:aws:s3:::bucket-name/*），避免遗漏桶级别的操作限制。
3. 默认拒绝未授权操作：新增Deny语句，拒绝除日志服务外所有主体的所有S3操作，严格遵循"默认拒绝，仅显式允许必要操作"的安全原则。

这样修改后，既能满足SonarQube的合规检查要求，也符合AWS的安全规范。

内容的提问来源于stack exchange，提问作者Rohit Patil