Saltar al contenido

Enabling and Centralizing S3, VPC, and Load Balancer Access Logs Across Multiple AWS Accounts

0

I manage multiple AWS accounts and need to enable access logging for S3 buckets, VPCs, and Load Balancers. How can I configure these logs for each account and centralize them in a single "Log" account?

1 Respuesta
1

The trivial answer will be to create a logging bucket allowing different accounts to write to it via Bucket Policies. Then you enable the logging for every service to point to that bucket.

A bucket policy may be like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountLogging",
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::ACCOUNT-ID-1:root", "arn:aws:iam::ACCOUNT-ID-2:root"]
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::your-log-bucket/*"
    }
  ]
}
EXPERTO

respondido hace 2 años

AWS
EXPERTO

revisado hace 2 años

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.