CODEWITHSUNDEEP
amazon-web-servicesamazon-s3terraformamazon-elbterraform-provider-aws
StarJedi
StarJedi

Reputation: 1520

Terraform - Enabling Access Load balancer logs InvalidConfigurationRequest: Access Denied for bucket

I'm using terraform to provision an ELB & want to Enable Access logs for ELB in a S3 bucket. When I try to apply the resources, I get the below error - InvalidConfiguration: Access Denied for bucket:

Below are my TF resources with the S3 bucket policy created using the IAM Policy Document.

resource "aws_lb" "this" {
  name               = var.name
  load_balancer_type = "application"

  access_logs {
    bucket  = aws_s3_bucket.this.bucket
    prefix  = var.name
    enabled = true
  }
}

resource "aws_s3_bucket" "this" {
  bucket        = "${var.bucket_name}"
  acl           = "log-delivery-write"
  force_destroy = true

}

resource "aws_s3_bucket_policy" "this" {
  bucket = "aws_s3_bucket.this.id"
  policy = "${data.aws_iam_policy_document.s3_bucket_lb_write.json}"
}


data "aws_iam_policy_document" "s3_bucket_lb_write" {
  policy_id = "s3_bucket_lb_logs"

  statement {
    actions = [
      "s3:PutObject",
    ]
    effect = "Allow"
    resources = [
      "${aws_s3_bucket.this.arn}/*",
    ]

    principals {
      identifiers = ["${data.aws_elb_service_account.main.arn}"]
      type        = "AWS"
    }
  }

  statement {
    actions = [
      "s3:PutObject"
    ]
    effect = "Allow"
    resources = ["${aws_s3_bucket.this.arn}/*"]
    principals {
      identifiers = ["delivery.logs.amazonaws.com"]
      type        = "Service"
    }
  }


  statement {
    actions = [
      "s3:GetBucketAcl"
    ]
    effect = "Allow"
    resources = ["${aws_s3_bucket.this.arn}"]
    principals {
      identifiers = ["delivery.logs.amazonaws.com"]
      type        = "Service"
    }
  }
}

output "bucket_name" {
  value = "${aws_s3_bucket.this.bucket}"
}

I get the following error

Error: Error putting S3 policy: NoSuchBucket: The specified bucket does not exist
        status code: 404, request id: 5932CFE816059A8D, host id: j5ZBQ2ptHXivx+fu7ai5jbM8PSQR2tCFo4IAvcLkuocxk8rn/r0TG/6YbfRloBFR2WSy8UE7K8Q=

Error: Failure configuring LB attributes: InvalidConfigurationRequest: Access Denied for bucket: test-logs-bucket-xyz. Please check S3bucket permission
        status code: 400, request id: ee101cc2-5518-42c8-9542-90dd7bb05e3c

terraform version Terraform v0.12.23

Upvotes: 5

Views: 13352

Answers (1)

Marcin
Marcin

Reputation: 238279

There is mistake in:

resource "aws_s3_bucket_policy" "this" {
  bucket = "aws_s3_bucket.this.id"
  policy = "${data.aws_iam_policy_document.s3_bucket_lb_write.json}"
}

it should be:

resource "aws_s3_bucket_policy" "this" {
  bucket = aws_s3_bucket.this.id
  policy = data.aws_iam_policy_document.s3_bucket_lb_write.json
}

The orginal version (bucket = "aws_s3_bucket.this.id") will just try to look for bucket literally called "aws_s3_bucket.this.id".

Upvotes: 6

Related Questions