如何通过Terraform配置AWS Macie敏感数据发现结果存储S3桶？

要解决控制台提示「配置S3桶以长期留存敏感数据发现结果」的问题，你需要通过Terraform配置aws_macie2_classification_export_configuration资源，关联专门存储发现结果的S3桶。以下是完整配置步骤和代码示例：

1. 创建存储发现结果的S3桶 #

首先创建一个S3桶，并配置桶策略允许Macie向其写入数据：

# 创建S3桶（桶名需全球唯一）
resource "aws_s3_bucket" "macie_findings_bucket" {
  bucket = "your-unique-macie-findings-bucket"
}

# 开启桶版本控制（可选，推荐用于数据留存）
resource "aws_s3_bucket_versioning" "macie_findings_bucket_versioning" {
  bucket = aws_s3_bucket.macie_findings_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

# 配置桶策略，允许Macie写入结果
resource "aws_s3_bucket_policy" "macie_findings_bucket_policy" {
  bucket = aws_s3_bucket.macie_findings_bucket.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "macie.amazonaws.com"
        }
        Action = ["s3:PutObject", "s3:PutObjectAcl"]
        Resource = "${aws_s3_bucket.macie_findings_bucket.arn}/*"
        Condition = {
          StringEquals = {
            "aws:SourceAccount" = data.aws_caller_identity.current.account_id
          }
        }
      }
    ]
  })
}

# 获取当前账户ID用于桶策略
data "aws_caller_identity" "current" {}

2. 配置Macie分类导出关联S3桶 #

通过aws_macie2_classification_export_configuration资源将Macie与S3桶关联，这就是控制台提示中需要配置的「敏感数据发现结果存储库」：

# 关联S3桶作为Macie发现结果存储库
resource "aws_macie2_classification_export_configuration" "macie_findings_export" {
  s3_destination {
    bucket_name = aws_s3_bucket.macie_findings_bucket.bucket
    key_prefix  = "macie-findings/" # 可选，给结果文件添加路径前缀
    # 若使用KMS加密桶，需添加kms_key_arn字段，示例如下：
    # kms_key_arn = aws_kms_key.macie_encryption_key.arn
  }
}

3. 可选：配置KMS加密（若需加密存储结果） #

如果需要用KMS加密S3桶中的发现结果，需创建KMS密钥并配置权限允许Macie访问：

# 创建KMS密钥
resource "aws_kms_key" "macie_encryption_key" {
  description = "KMS key for encrypting Macie sensitive data findings"
}

# 配置KMS密钥策略，允许Macie使用密钥
resource "aws_kms_key_policy" "macie_key_policy" {
  key_id = aws_kms_key.macie_encryption_key.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "macie.amazonaws.com"
        }
        Action = ["kms:GenerateDataKey", "kms:Decrypt"]
        Resource = "*"
        Condition = {
          StringEquals = {
            "aws:SourceAccount" = data.aws_caller_identity.current.account_id
          }
        }
      }
    ]
  })
}

关键说明 #

• 确保你的Terraform配置中已经启用了Macie账户（通常通过aws_macie2_account资源）：

  resource "aws_macie2_account" "enabled" {
    status = "ENABLED"
  }
  

• 配置完成并应用Terraform后，控制台的「配置S3桶以长期留存敏感数据发现结果」提示会自动消失，Macie会将后续的敏感数据发现结果自动导出到指定S3桶。

内容的提问来源于stack exchange，提问作者ErnieAndBert