IAM 和跨账户写入 S3 存储桶：允许基于组织 ID 的服务主体

Question

我有很多 AWS 账户。我为所有这些启用了 VPC 流日志，我想将这些日志发送到我的日志存档帐户中的中央 S3 存储桶。

一个有效的 IAM 策略如下：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AWSLogDeliveryWrite",
        "Effect": "Allow",
        "Principal": {"Service": "delivery.logs.amazonaws.com"},
        "Action": "s3:PutObject",],
        "Resource": "arn:aws:s3:::central_log_archive_bucket",
        "Condition": {
            "StringEquals": {
                "aws:SourceAccount": <account_id-1>,
                "aws:SourceAccount": <account_id-2>,
                "aws:SourceAccount": <account_id-3>,
                ...
                "aws:SourceAccount": <account_id-N>
            },
            "ArnLike": {
                "aws:SourceArn": "arn:aws:logs:*:<account_id-1>:*",
                "aws:SourceArn": "arn:aws:logs:*:<account_id-2>:*",
                "aws:SourceArn": "arn:aws:logs:*:<account_id-3>:*",
                ...
                "aws:SourceArn": "arn:aws:logs:*:<account_id-N>:*",

            }
        }
    }
  ]
}

我想简化这个。我不想像上面那样添加所有帐户 ID，而是希望允许属于我组织下的 AWS 帐户的任何 VPC 服务将日志发布到 S3。简而言之，我想做类似的事情：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AWSLogDeliveryWrite",
        "Effect": "Allow",
        "Principal": {"Service": "delivery.logs.amazonaws.com"},
        "Action": "s3:PutObject",],
        "Resource": "arn:aws:s3:::central_log_archive_bucket",
        "Condition": {
         "StringEquals": {
          "aws:PrincipalOrgID": "ID"
         }
        }
    }
  ]
}

但我看到以下错误消息：

Unsupported Condition Key for Service Principal

知道如何进行这项工作吗？

Answer 1

如此处所述https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html、

某些服务主体不能使用某些条件键。例如，您不能将 aws:PrincipalOrgID 条件键与服务主体 cloudfront.amazonaws.com. 或其他服务（如日志）一起使用。您应该删除不适用于 Principal 元素中的服务主体的条件键。

您可以在创建每个帐户时使用 lambda 自动执行它，例如，更改存储桶策略...

IAM 和跨账户写入 S3 存储桶：允许基于组织 ID 的服务主体

IAM & Cross-account write to S3 bucket: Allow service principal based on organisation ID

amazon-web-services

amazon-s3

amazon-iam

amazon-vpc