跳至內容

Enabling and Centralizing S3, VPC, and Load Balancer Access Logs Across Multiple AWS Accounts

0

I manage multiple AWS accounts and need to enable access logging for S3 buckets, VPCs, and Load Balancers. How can I configure these logs for each account and centralize them in a single "Log" account?

1 個回答
1

The trivial answer will be to create a logging bucket allowing different accounts to write to it via Bucket Policies. Then you enable the logging for every service to point to that bucket.

A bucket policy may be like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountLogging",
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::ACCOUNT-ID-1:root", "arn:aws:iam::ACCOUNT-ID-2:root"]
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::your-log-bucket/*"
    }
  ]
}
專家

已回答 2 年前

AWS
專家

已審閱 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。