如何解决创建或更新跟踪时的 CloudTrail 加密权限错误？

3 分钟阅读

当我尝试创建 AWS CloudTrail 跟踪或更新现有跟踪时，我收到 "InsufficientEncryptionPolicyException" 或 "Insufficient permissions" 错误。

解决方法

要创建或更新包含加密日志的 CloudTrail 跟踪，CloudTrail 需要获得将日志写入启用 AWS Key Management Service (AWS KMS) 加密的 Amazon Simple Storage Service (Amazon S3) 存储桶的权限。

要解决 "InsufficientEncryptionPolicyException" 或 "Insufficient permissions to access S3 bucket or KMS key" 错误，请更新 AWS KMS 密钥策略。然后，使用所需的 CloudTrail 权限配置 Amazon S3 存储桶策略。

更新 AWS KMS 密钥策略以允许 CloudTrail 加密

完成以下步骤：

打开 CloudTrail 控制台。
选择您的 CloudTrail 跟踪。
在 Log file SSE-KMS encryption（日志文件 SSE-KMS 加密）下，复制 AWS KMS 密钥 ID。
打开 AWS KMS 控制台。
搜索 AWS KMS 密钥 ID，然后从 AWS KMS 密钥列表中选择您的密钥。
选择 Permissions（权限）。
在 Key policy（密钥策略）下，选择 Switch to policy view（切换到策略视图）。
选择 Edit（编辑）。

检查您的 AWS KMS 密钥策略是否具有以下权限：

{
    "Version": "2012-10-17",
    "Id": "Key policy created by CloudTrail",
    "Statement": [
        {
            "Sid": "Enable admin permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::111122223333:root"
                ]
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow CloudTrail to encrypt logs",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
             },
            "Action": "kms:GenerateDataKey*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
                }
            }
        },
        {
            "Sid": "Allow CloudTrail to describe key",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
             },
            "Action": "kms:DescribeKey",
            "Resource": "*"
        },
        {
            "Sid": "Allow principals in other account to decrypt log files",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
             },
            "Action": [
                "kms:Decrypt",
                "kms:ReEncryptFrom"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:111122223333:trail/*"
                }
            }
        }
    ]
}

**注意：**请将 arn:aws:iam::111122223333:root 替换为您的 AWS Identity and Access Management (IAM) 的 Amazon 资源名称 (ARN)。将 arn:aws:cloudtrail:region:111122223333:trail/trailName 替换为您的 CloudTrail 跟踪的 ARN。

更新 S3 存储桶策略以允许 CloudTrail 获得写入日志的权限

**重要事项：**请将 arn:aws:cloudtrail:region:111122223333:trail/trailName 替换为您的 CloudTrail 跟踪的 ARN，将 Bucket_Name 替换为您的 S3 存储桶名称，并将 managementAccountID 和 o-organizationID 替换为您的 AWS Organizations 详细信息。如果您使用前缀，请将 optionalPrefix 替换为您的前缀路径。

如果您在组织中创建了跟踪，请使用以下策略语句更新 S3 存储桶策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSCloudTrailAclCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::Bucket_Name",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
                }
            }
        },
        {
            "Sid": "AWSCloudTrailWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::Bucket_Name/AWSLogs/managementAccountID/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
                }
            }
        },
        {
            "Sid": "AWSCloudTrailOrganizationWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::Bucket_Name/AWSLogs/o-organizationID/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
                }
            }
        }
    ]
}

如果您没有在组织中创建跟踪，请改用以下策略语句更新 S3 存储桶策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::Bucket_Name",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
        }
      }
    },
    {
      "Sid": "AWSCloudTrailWritePermissions",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::Bucket_Name/optionalPrefix/AWSLogs/111122223333/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control",
          "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
        }
      }
    }
  ]
}

（可选）更新现有跟踪的 S3 存储桶策略

**注意：**创建新跟踪时，此选项不可用。