CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-elb
Jim_Mcdonalds
Jim_Mcdonalds

Reputation: 496

S3 Policy for Application Load Balancer

I am struggling with the setting up an S3 policy to give access to Application Load Balancer to push logs.

{
  "Id": "Policy1629585161607",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1629585158642",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::S3bucketname/*",
      "Principal": {
        "AWS":"arn:aws:iam:LoadBalancerId:root"
      }
    }
  ]
}

The LoadBalancerIdcame from the last part of the loan balancer's ARN; follows the trailing slash after the load balancer's name in the ARN.

The error got from S3 is Invalid principal in policy, what have I done wrong?

Upvotes: 1

Views: 1928

Answers (1)

Marcin
Marcin

Reputation: 238407

The AWS docs explain well what the policy should be exactly. Sadly, your policy is incorrect. It should follow the following format:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::elb-account-id:root"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/prefix/AWSLogs/your-aws-account-id/*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "delivery.logs.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/prefix/AWSLogs/your-aws-account-id/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "delivery.logs.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::bucket-name"
    }
  ]
}

On top of that, bucket must be in same region and be encrypted.

Upvotes: 2

Related Questions