amazon-ec2 - Aws IAM 组:在 Terraform 上的日志组上设置只读访问权限
问题描述
有人知道如何设置对特定日志组的只读访问权限吗?
resource "aws_iam_policy" "logs" {
name = "AWSLogs${title(var.product)}"
description = "Logging policy for ${title(var.product)}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:Get*",
"logs:List*",
"logs:Filter*"
],
"Resource": [
"arn:aws:logs:::log-group:${aws_cloudwatch_log_group.one.arn}:log-stream:*",
"arn:aws:logs:::log-group:${aws_cloudwatch_log_group.two.arn}:log-stream:*",
"arn:aws:logs:::log-group:${aws_cloudwatch_log_group.three.arn}:log-stream:*"
]
},
{
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups"
],
"Resource": "*"
}
]
}
EOF
}
resource "aws_iam_group_policy_attachment" "logs" {
group = "${aws_iam_group.logs.name}"
policy_arn = "${aws_iam_policy.logs.arn}"
}
resource "aws_iam_group" "logs" {
name = "${title(var.product)}Logs"
}
我目前正在努力设置只能访问指定的日志组,但是当我将资源设置为“*”时,我只能访问它们。当我将其设置为专用于预定义的日志组时,这是不可能的。有人有好的做法或解决方案吗?当我在上面尝试这个解决方案时,我只得到
未授权执行: logs:FilterLogEvents ,当我尝试通过属于 IAM 组“日志”的用户访问它时。
解决方案
aws_cloudwatch_log_group.one.arn
已经是one
日志组的完整 ARN,即
arn:aws:logs:us-east-1:123456789012:log-group:one
因此,请仅参考Resources
列表中的内容:
resource "aws_iam_policy" "logs" {
name = "AWSLogs${title(var.product)}"
description = "Logging policy for ${title(var.product)}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:Get*",
"logs:List*",
"logs:Filter*"
],
"Resource": [
"${aws_cloudwatch_log_group.one.arn}:log-stream:*",
"${aws_cloudwatch_log_group.two.arn}:log-stream:*",
"${aws_cloudwatch_log_group.three.arn}:log-stream:*"
]
},
{
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups"
],
"Resource": "*"
}
]
}
EOF
}
推荐阅读
- ansible - Ansible 不会通过 Telnet 连接到模拟网络设备
- c# - 图片的内容类型无效(.net core sdk 2.1)
- mysql - 使用 VARBINARY(max) 存储图像时出现 SQL 错误
- android - 无法解析来自 Android 支持存储库的导入(包括 Google 的 Maven)
- python - 循环遍历 pandas 的数据框行并比较列上的值
- java - java中Deques接口的addFirst(element)和push(element)方法有什么区别?
- apache-spark - spark aggregateByKey 添加额外的空行
- mysql - 在mysql中获取最近6个月的记录
- c# - IFormFile 在 asp.net core 2.1 中总是返回 null
- flutter - 如何实现 Flood-fill 算法?