创建关联AWS KMS CMK的CloudWatch日志组遇权限错误排查

问题详情 #

需为CloudWatch日志组关联AWS KMS CMK，已通过Terraform配置CMK内联策略，代码如下：

module "component_cmk_log" {
  source      = "cmk-logroup-source"
  name        = "${var.environment}_loggroup_cmk"
  environment = terraform.workspace
  key_policy  = data.aws_iam_policy_document.cmk-log-group.json
}


data "aws_iam_policy_document" "cmk-log-group" {
  statement {
    sid    = "Enable IAM User Permissions"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${account_id}:root"]
    }

    actions = [
      "kms:*"
    ]
    resources = ["*"]
  }
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["logs.${var.region}.amazonaws.com"]
    }
    actions = [
      "kms:Encrypt*",
      "kms:Decrypt*",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:Describe*"
    ]

    resources = ["*"]
    condition {
      test = "ArnLike"
      values = [
        "arn:aws:logs:${var.region}:${account_id}:*"
      ]
      variable = "kms:EncryptionContext:arn:aws:logs"
    }
  }

}

执行terraform apply时触发错误：

Creating CloudWatch Log Group failed: AccessDeniedException: The specified KMS key does not exist or is not allowed to be used with LogGroup 'arn:aws:logs:eu-west-1:123456789:log-group:/test/dev/applications/loggroup/files.out'

排查与修复方案 #

• 修正KMS密钥策略的加密上下文变量：当前策略中variable = "kms:EncryptionContext:arn:aws:logs"不符合AWS规范，CloudWatch日志服务调用KMS时使用的加密上下文键是aws:logs:arn，正确的变量名应为kms:EncryptionContext:aws:logs:arn。修改后的Condition块：

  condition {
    test = "ArnLike"
    values = [
      "arn:aws:logs:${var.region}:${account_id}:*"
    ]
    variable = "kms:EncryptionContext:aws:logs:arn"
  }
  

• 确认日志组与CMK的ARN关联正确性：检查Terraform中配置日志组时，指定的KMS密钥ARN是否为module.component_cmk_log输出的有效ARN，避免引用错误密钥或未正确导出模块输出。
• 验证CMK状态：确保CMK处于启用状态，未被禁用或标记为计划删除。
• 检查执行角色权限：执行terraform apply的IAM角色需具备kms:DescribeKey、kms:CreateGrant权限，因为创建日志组时需为CloudWatch日志服务在KMS上创建授权。
• 确认区域一致性：CMK与目标日志组必须处于同一AWS区域（错误显示区域为eu-west-1，需确保CMK部署在该区域）。

内容的提问来源于stack exchange，提问作者TheWalkingMalteser