授予 AWS Config 访问 Amazon S3 存储桶的权限
Granting AWS Config access to the Amazon S3 Bucket
我想创建对 Amazon S3 存储桶的 AWS Config 访问授权,下面提供了我根据 link https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html:
编写的策略
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSConfigBucketPermissionsCheck",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::targetBucketName"
},
{
"Sid": "AWSConfigBucketExistenceCheck",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::targetBucketName"
},
{
"Sid": "AWSConfigBucketDelivery",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::targetBucketName/[optional] prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
我想了解下面提供的部分:
"Resource": "arn:aws:s3:::targetBucketName/[optional] prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*",
prefix
的含义是什么?如何填写政策的 prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*
部分?
谢谢。
前缀是您在将日志记录配置到 S3 时定义的。这是可选的。 Config 使用标准 path/key 格式将日志写入 S3 存储桶,格式为“prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*”。
如果您从控制台将配置日志记录配置到 S3,您将不必担心存储桶策略,因为它会自动创建。您只需提供存储桶名称和可选前缀。
我想创建对 Amazon S3 存储桶的 AWS Config 访问授权,下面提供了我根据 link https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html:
编写的策略{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSConfigBucketPermissionsCheck",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::targetBucketName"
},
{
"Sid": "AWSConfigBucketExistenceCheck",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::targetBucketName"
},
{
"Sid": "AWSConfigBucketDelivery",
"Effect": "Allow",
"Principal": {
"Service": [
"config.amazonaws.com"
]
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::targetBucketName/[optional] prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
我想了解下面提供的部分:
"Resource": "arn:aws:s3:::targetBucketName/[optional] prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*",
prefix
的含义是什么?如何填写政策的 prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*
部分?
谢谢。
前缀是您在将日志记录配置到 S3 时定义的。这是可选的。 Config 使用标准 path/key 格式将日志写入 S3 存储桶,格式为“prefix/AWSLogs/sourceAccountID-WithoutHyphens/Config/*”。
如果您从控制台将配置日志记录配置到 S3,您将不必担心存储桶策略,因为它会自动创建。您只需提供存储桶名称和可选前缀。