Skip to content

Instantly share code, notes, and snippets.

@dsmrt

dsmrt/log-bucket-policy.json

Created July 13, 2022 20:25
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dsmrt/f8c8f33c826cf65b8dacddb6522bd7dd to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dsmrt/f8c8f33c826cf65b8dacddb6522bd7dd to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. dsmrt created this gist Jul 13, 2022.
    38 changes: 38 additions & 0 deletions log-bucket-policy.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,38 @@
    {
    "Version": "2012-10-17",
    "Id": "AWSConsole-AccessLogs-Policy",
    "Statement": [
    {
    "Sid": "AWSConsoleStmt",
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::${AwsAccount}:root"
    },
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::${Bucket}/loadbalancer/AWSLogs/${AwsAccount}/*"
    },
    {
    "Sid": "AWSLogDeliveryWrite",
    "Effect": "Allow",
    "Principal": {
    "Service": "delivery.logs.amazonaws.com"
    },
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::${Bucket}/loadbalancer/AWSLogs/${AwsAccount}/*",
    "Condition": {
    "StringEquals": {
    "s3:x-amz-acl": "bucket-owner-full-control"
    }
    }
    },
    {
    "Sid": "AWSLogDeliveryAclCheck",
    "Effect": "Allow",
    "Principal": {
    "Service": "delivery.logs.amazonaws.com"
    },
    "Action": "s3:GetBucketAcl",
    "Resource": "arn:aws:s3:::${Bucket}"
    }
    ]
    }