Terraform配置S3到Glue Workflow的Event Bridge时CloudTrail权限错误

核心问题分析 #

你的CloudTrail角色仅配置了信任策略（允许CloudTrail服务扮演该角色），但缺少权限策略（允许该角色写入CloudWatch Logs、访问KMS密钥等必要操作），同时存在几处配置细节错误。

分步解决方案 #

1. 为CloudTrail角色添加权限策略 #

创建内联策略，授予角色写入CloudWatch Logs的最小权限；如果日志组使用KMS加密，还需添加KMS访问权限：

resource "aws_iam_role_policy" "cloudtrail_cw_logs" {
  name   = "cloudtrail-cw-logs-permissions"
  role   = aws_iam_role.cloud_trail.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # 允许写入指定的CloudWatch日志组
      {
        Effect   = "Allow"
        Action   = ["logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = aws_cloudwatch_log_group.tran_hist_log_group.arn
      },
      # 如果日志组启用KMS加密，添加KMS权限
      {
        Effect   = "Allow"
        Action   = ["kms:GenerateDataKey", "kms:Decrypt"]
        Resource = module.kms_key.key_arn
      }
    ]
  })
}

2. 确保KMS密钥策略允许CloudTrail角色访问 #

如果CloudWatch日志组关联了KMS密钥，需要在KMS密钥策略中显式允许CloudTrail角色使用该密钥。修改KMS模块配置：

module "kms_key" {
  source = "cloudposse/kms-key/aws"

  stage                   = var.environment
  namespace               = var.organization
  name                    = "tran_hist_kms"
  description             = "KMS key for app"
  deletion_window_in_days = 10
  enable_key_rotation     = true
  alias                   = "alias/parameter_store_key"

  # 添加允许CloudTrail角色访问的策略语句
  key_policy_statements = [
    {
      Sid       = "AllowCloudTrailRoleAccess"
      Effect    = "Allow"
      Principal = {
        AWS = aws_iam_role.cloud_trail.arn
      }
      Action   = ["kms:GenerateDataKey", "kms:Decrypt"]
      Resource = "*"
    }
  ]
}

3. 修正CloudTrail的Data Resource配置 #

当前data_resource的values = ["arn:aws:s3"]配置无效，需指定具体的S3桶ARN（包含对象路径）：

event_selector {
  read_write_type           = "All"
  include_management_events = true

  data_resource {
    type   = "AWS::S3::Object"
    # 替换为目标S3桶ARN，末尾加/*匹配所有对象
    values = ["arn:aws:s3:::${module.s3_bucket_cloud_trail_log_…..bucket_id}/*"]
  }
}

4. 验证CloudWatch日志组ARN引用正确性 #

确保CloudTrail配置中的日志组ARN引用准确，例如：

cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.tran_hist_log_group.arn}:*"

验证步骤 #

应用修改后重新执行部署：

1. 运行terraform plan检查配置无语法错误
2. 运行terraform apply部署资源
3. 查看CloudTrail状态，确认日志成功流向CloudWatch日志组

内容的提问来源于stack exchange，提问作者Mohammad Etemad