CloudFormation部署AWS Config遇S3 Bucket写入错误求正确模板

下面是可以解决「无法写入Bucket」错误的完整CloudFormation模板，包含S3 Bucket、Bucket Policy、AWS Config所需的IAM角色、配置记录器和交付通道：

AWSTemplateFormatVersion: '2010-09-09'
Description: 集成AWS Config与S3 Bucket的完整配置

Resources:
  # 用于存储Config日志的S3 Bucket
  ConfigS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "config-logs-${AWS::AccountId}-${AWS::Region}"
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  # 允许AWS Config写入Bucket的Bucket Policy
  ConfigBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ConfigS3Bucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowConfigServicePutObject
            Effect: Allow
            Principal:
              Service: config-service.amazonaws.com
            Action:
              - s3:PutObject
              - s3:PutObjectAcl
            Resource: !Sub "arn:aws:s3:::${ConfigS3Bucket}/AWSLogs/${AWS::AccountId}/Config/*"
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
              ArnLike:
                aws:SourceArn: !Sub "arn:aws:config:${AWS::Region}:${AWS::AccountId}:*"
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId

  # AWS Config所需的IAM角色
  ConfigServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: config.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSConfigRole

  # AWS Config配置记录器
  ConfigRecorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      RoleARN: !GetAtt ConfigServiceRole.Arn
      RecordingGroup:
        AllSupported: true
        IncludeGlobalResourceTypes: true

  # AWS Config交付通道
  ConfigDeliveryChannel:
    Type: AWS::Config::DeliveryChannel
    Properties:
      S3BucketName: !Ref ConfigS3Bucket
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: TwentyFour_Hours

关键配置说明 #

• Bucket Policy：明确授权config-service.amazonaws.com服务主体执行s3:PutObject和s3:PutObjectAcl操作，同时通过aws:SourceAccount和aws:SourceArn条件限制仅当前账号的AWS Config服务能访问，确保安全性。s3:x-amz-acl条件强制设置对象权限为桶所有者完全控制，避免权限归属问题。
• S3 Bucket：启用版本控制并开启公有访问阻止，符合AWS安全最佳实践。
• Config角色：使用AWS托管的AWSConfigRole策略，确保Config拥有记录资源配置所需的全部权限。
• 交付通道：指定存储Config日志的S3 Bucket，配置快照交付频率为24小时（可按需调整为其他频率，如One_Hour、Six_Hours等）。

内容的提问来源于stack exchange，提问作者DrewCargle