S3存储桶触发s3-bucket-policy-grantee-check-conformance-pack不合规求助

• 触发s3-bucket-policy-grantee-check-conformance-pack校验失败的核心原因是你给CloudTrail服务的跨服务授权未添加账户限制，规则判定该配置存在未受控的跨账号访问风险：你当前两条给cloudtrail.amazonaws.com的Allow语句没有限定仅你自己的AWS账户可调用该权限，理论上其他AWS账户的CloudTrail服务也可以访问你的存储桶，不符合安全基线要求。
• 次要问题是第三条Deny语句的Sid和实际配置逻辑不匹配：你标注的Sid是DenyUnEncryptedObjectUploads（拒绝未加密对象上传），但实际配置的Action是s3:GetObject且Condition是限制非HTTPS访问，该配置逻辑错误会导致部分规则版本额外触发风险告警。

替换策略中bucket-name为你的实际存储桶名称、你的12位AWS账户ID为你真实的AWS账号ID即可：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSCloudTrailAclCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::bucket-name",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "你的12位AWS账户ID"
                }
            }
        },
        {
            "Sid": "AWSCloudTrailWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceAccount": "你的12位AWS账户ID"
                }
            }
        },
        {
            "Sid": "DenyInsecureTransportAccess",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket-name/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

更新策略后可手动触发AWS Config合规包重检，最长12小时内会自动刷新合规状态，更新后校验结果会变为合规。

内容的提问来源于stack exchange，提问作者PhilipCTVP