如何解決在建立或更新軌跡時，出現的 CloudTrail 加密權限錯誤？

3 分的閱讀內容

當我嘗試建立 AWS CloudTrail 軌跡或更新現有追蹤時，收到「InsufficientEncryptionPolicyException」或「Insufficient permissions」錯誤。

解決方法

若要建立或更新使用加密日誌的 CloudTrail 軌跡，CloudTrail 需要具備使用 AWS Key Management Service (KMS) 加密，將日誌寫入 Amazon Simple Storage Service (Amazon S3) 儲存貯體的權限。

若要解決「InsufficientEncryptionPolicyException」或「Insufficient permissions to access S3 bucket or KMS key」錯誤，請更新 AWS KMS key 政策。接著，設定 Amazon S3 儲存貯體政策，加入 CloudTrail 所需的權限。

更新 AWS KMS key 政策以允許 CloudTrail 進行加密

請完成以下步驟：

開啟 CloudTrail console (CloudTrail 主控台)。
選取您的 CloudTrail 軌跡。
在 Log file SSE-KMS encryption (日誌檔案 SSE-KMS 加密) 下，複製 AWS KMS key ID。
開啟 AWS KMS console (AWS KMS 主控台)。
搜尋 AWS KMS key ID，然後從 AWS KMS key 清單中選取您的金鑰。
選擇 Permissions (權限)。
在 Key policy (金鑰政策) 下，選擇 Switch to policy view (切換至政策檢視)。
選擇 Edit (編輯)。

確認您的 AWS KMS key 政策包含以下權限：

{
    "Version": "2012-10-17",
    "Id": "Key policy created by CloudTrail",
    "Statement": [
        {
            "Sid": "Enable admin permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::111122223333:root"
                ]
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow CloudTrail to encrypt logs",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
             },
            "Action": "kms:GenerateDataKey*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
                }
            }
        },
        {
            "Sid": "Allow CloudTrail to describe key",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
             },
            "Action": "kms:DescribeKey",
            "Resource": "*"
        },
        {
            "Sid": "Allow principals in other account to decrypt log files",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
             },
            "Action": [
                "kms:Decrypt",
                "kms:ReEncryptFrom"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:111122223333:trail/*"
                }
            }
        }
    ]
}

**注意：**將 arn:aws:iam::111122223333:root 替換為您 AWS Identity and Access Management (IAM) 的 Amazon Resource Name (ARN)。將 arn:aws:cloudtrail:region:111122223333:trail/trailName 替換為您的 CloudTrail 軌跡 ARN。

更新 S3 儲存貯體政策，以允許 CloudTrail 寫入日誌

**重要：**將 arn:aws:cloudtrail:region:111122223333:trail/trailName 替換為您的 CloudTrail 軌跡 ARN，將 Bucket_Name 替換為您的 S3 儲存貯體名稱，並將 managementAccountID 與 o-organizationID 替換為您的 AWS Organizations 詳細資訊。如果您使用首碼，請將 optionalPrefix 替換為您的首碼路徑。

如果您是在 organization (組織) 中建立軌跡，請使用以下政策陳述式更新 S3 儲存貯體政策：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSCloudTrailAclCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::Bucket_Name",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
                }
            }
        },
        {
            "Sid": "AWSCloudTrailWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::Bucket_Name/AWSLogs/managementAccountID/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
                }
            }
        },
        {
            "Sid": "AWSCloudTrailOrganizationWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::Bucket_Name/AWSLogs/o-organizationID/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
                }
            }
        }
    ]
}

如果您不是在組織中建立軌跡，請改用以下政策陳述式更新 S3 儲存貯體政策：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::Bucket_Name",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
        }
      }
    },
    {
      "Sid": "AWSCloudTrailWritePermissions",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::Bucket_Name/optionalPrefix/AWSLogs/111122223333/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control",
          "aws:SourceArn": "arn:aws:cloudtrail:region:111122223333:trail/trailName"
        }
      }
    }
  ]
}

(選用) 為現有軌跡更新 S3 儲存貯體政策

**注意：**建立新軌跡時無法使用此選項。