创建AWS ALB时遇S3存储桶权限拒绝错误求助

创建Application Load Balancer（ALB）时遇到以下错误：

Error: failure configuring LB attributes: InvalidConfigurationRequest: Access Denied for bucket: lb-11. Please check S3bucket permission
│       status code: 400, request id: 2940f342-8e1e-4d6b-b653-5aa5d231d4cf

已查阅AWS官方文档、GitHub相关问题及多篇Stack Overflow帖子，未发现遗漏配置；多次验证S3存储桶策略，看似配置正确，但错误依旧。

AWS文档给出的故障排查项已全部确认无问题：

• 存储桶策略未授予Elastic Load Balancing向存储桶写入访问日志的权限。
• 存储桶使用了不支持的服务器端加密选项，必须使用Amazon S3托管密钥（SSE-S3）。

区域：eu-central-1

存储桶策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::054676820928:root"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::lb-11/alb/AWSLogs/3583xxxxxx/*"
        }
    ]
}

加密密钥配置 #

Terraform配置 #

main.tf #

module "alb" {
  source  = "terraform-aws-modules/alb/aws"
  version = "8.7.0"
#AWS LB Input Parameters
  name                  = var.name
  load_balancer_type    = var.load_balancer_type
  internal              = var.internal
  subnets               = var.alb_subnets
  idle_timeout          = var.idle_timeout
  enable_deletion_protection                  = var.enable_deletion_protection
  enable_http2                                = var.enable_http2
  ip_address_type                             = var.ip_address_type
  drop_invalid_header_fields                  = var.drop_invalid_header_fields
  access_logs           = var.access_logs
  tags                  = var.mandatory_tags
  lb_tags               = var.lb_tags
  target_groups         = var.target_groups
  vpc_id                = var.tefde_vpcId

#AWS LB Target Group Input Parameters
  target_group_tags     = var.lb_tags

#AWS LB Listener Rules Input Parameters
  https_listener_rules          = var.https_listener_rules
  http_tcp_listener_rules       = var.http_tcp_listener_rules
  https_listener_rules_tags     = var.lb_tags
  http_tcp_listener_rules_tags  = var.lb_tags

#AWS LB Listener Input Parameters
  http_tcp_listeners       = var.http_tcp_listeners
  http_tcp_listeners_tags  = var.lb_tags
  https_listeners          = var.https_listeners
  https_listeners_tags     = var.lb_tags

#AWS LB Security Group Input Parameters
  security_group_name           = var.security_group_name
  security_group_description    = var.security_group_description
  security_group_tags           = var.lb_tags
  security_group_rules          = var.security_group_rules
}

terraform.tfvars #

##ALB##
name                            = "dev-LoadBalancer"
load_balancer_type              = "application"
internal                        = true
alb_subnets                     = ["subnet-00xxx", "subnet-05xxx"]
idle_timeout                    = 60
enable_deletion_protection      = true
enable_http2                    = true
ip_address_type                 = "ipv4"
drop_invalid_header_fields      = true
access_logs = {
  enabled = true
  bucket  = "lb-11"
  prefix  = "alb"
}
lb_tags = {
  applicationtype = "app"
}

恳请协助排查此权限拒绝错误。

内容的提问来源于stack exchange，提问作者Saurabh