Terraform中为CloudWatch Log Destination配置跨账号访问策略实现日志订阅

核心结论 #

完全可以用aws_cloudwatch_log_destination实现跨账号日志订阅收集，但Terraform中需要单独配置目标的资源策略——因为aws_cloudwatch_log_destination资源本身不包含权限控制字段，必须通过aws_cloudwatch_log_destination_policy资源绑定访问规则，允许成员账号（spoke accounts）向该目标推送日志。

Terraform实现步骤 #

1. 集中账号（Hub Account）配置 #

先创建CloudWatch Log Destination（以对接Kinesis Firehose为例，这是集中式日志方案的常见接收端），然后绑定权限策略：

# 假设已提前创建Kinesis Firehose作为日志接收端
data "aws_kinesis_firehose_delivery_stream" "log_stream" {
  name = "centralized-log-firehose"
}

# 创建CloudWatch Log Destination
resource "aws_cloudwatch_log_destination" "central_log_dest" {
  name       = "cross-account-log-destination"
  role_arn   = aws_iam_role.log_dest_role.arn # 该角色需允许CloudWatch调用Firehose的权限
  target_arn = data.aws_kinesis_firehose_delivery_stream.log_stream.arn
}

# 创建IAM角色，允许CloudWatch向Firehose推送日志
resource "aws_iam_role" "log_dest_role" {
  name = "cloudwatch-log-destination-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "logs.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "log_dest_policy" {
  name = "cloudwatch-log-destination-policy"
  role = aws_iam_role.log_dest_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "firehose:PutRecordBatch"
        Effect = "Allow"
        Resource = data.aws_kinesis_firehose_delivery_stream.log_stream.arn
      }
    ]
  })
}

# 关键：配置Destination的资源策略，允许指定成员账号创建订阅过滤器
resource "aws_cloudwatch_log_destination_policy" "cross_account_policy" {
  destination_name = aws_cloudwatch_log_destination.central_log_dest.name
  access_policy    = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "logs:PutSubscriptionFilter"
        Effect = "Allow"
        Principal = {
          AWS = [
            "arn:aws:iam::123456789012:root", # 成员账号1
            "arn:aws:iam::098765432109:root"  # 成员账号2
          ]
        }
        Resource = aws_cloudwatch_log_destination.central_log_dest.arn
      }
    ]
  })
}

2. 成员账号（Spoke Account）配置 #

在成员账号中，针对需要收集的日志组创建订阅过滤器，指向集中账号的Destination ARN：

# 订阅目标日志组到集中账号的Destination
resource "aws_cloudwatch_log_subscription_filter" "app_log_subscription" {
  name            = "app-logs-to-central-hub"
  log_group_name  = "/aws/app/my-application-logs"
  destination_arn = "arn:aws:logs:us-east-1:999999999999:destination:cross-account-log-destination" # 替换为集中账号的Destination ARN
  filter_pattern  = "" # 留空表示收集所有日志，可根据需求设置过滤规则
}

常见问题排查 #

• 权限报错：检查集中账号的aws_cloudwatch_log_destination_policy中是否正确添加了成员账号的ARN，确保没有拼写错误。
• 角色权限不足：确认集中账号中绑定给Destination的IAM角色（log_dest_role）拥有对接目标服务（如Firehose、Lambda）的推送权限。
• 跨区域限制：CloudWatch订阅过滤器要求日志组和Destination必须在同一区域，若需跨区域收集，需先通过跨区域复制将日志同步到目标区域，再配置订阅。

内容的提问来源于stack exchange，提问作者alphatango165