使用 Amazon CLI 将日志数据导出到 Amazon S3

输入以下命令以创建 IAM 角色。

aws iam create-user --user-name CWLExportUser

将 IAM 托管策略附加到您刚刚创建的 IAM 用户。

export S3POLICYARN=$(aws iam list-policies --query 'Policies[?PolicyName==`AmazonS3FullAccess`].{ARN:Arn}' --output text)

export CWLPOLICYARN=$( aws iam list-policies --query 'Policies[?PolicyName==`CloudWatchLogsFullAccess`].{ARN:Arn}' --output text)

aws iam attach-user-policy --user-name CWLExportUser --policy-arn $S3POLICYARN

aws iam attach-user-policy --user-name CWLExportUser --policy-arn $CWLPOLICYARN

确认已附加两个托管策略。

aws iam list-attached-user-policies --user-name CWLExportUser

将 Amazon CLI 配置为包含 CWLExportUser IAM 用户的 IAM 凭证。有关更多信息，请参阅配置 Amazon CLI。

创建一个名为 policy.json 的文件并添加以下访问策略，将 Resource 更改为您的 S3 存储桶的名称，并将 Principal 更改为您要将日志数据导出到的区域的终端节点。使用文本编辑器以创建此策略文件。请勿使用 IAM 控制台。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "s3:GetBucketAcl",
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my-exported-logs",
            "Principal": { "Service": "logs.us-east-2.amazonaws.com" }
        },
        {
            "Action": "s3:PutObject" ,
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my-exported-logs/*",
            "Condition": { 
                "StringEquals": { 
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceAccount": [
                        "AccountId1",
                        "AccountId2",
                        ...
                    ]
                 }
              },
            "Principal": { "Service": "logs.us-east-2.amazonaws.com" }
        }
    ]
}

使用 put-bucket-policy 命令将您刚添加的策略设置为存储桶上的访问策略。此策略可让 CloudWatch Logs 将日志数据导出到您的 S3 桶中。存储桶拥有者将对所有导出的对象拥有完全权限。

aws s3api put-bucket-policy --bucket my-exported-logs --policy file://policy.json

使用文本编辑器创建名为 key_policy.json 的文件，并添加以下访问策略。添加策略时，进行以下更改：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow CWL Service Principal usage",
            "Effect": "Allow",
            "Principal": {
                "Service": "logs.Region.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "account-ARN"
            },
            "Action": [
                "kms:GetKeyPolicy*",
                "kms:PutKeyPolicy*",
                "kms:DescribeKey*",
                "kms:CreateAlias*",
                "kms:ScheduleKeyDeletion*",
                "kms:Decrypt"
            ],
            "Resource": "*"
        }
    ]
}

输入以下命令：

aws kms create-key --policy file://key_policy.json

下面是此命令的示例输出：

{
    "KeyMetadata": {
        "AWSAccountId": "account_id",
        "KeyId": "key_id",
        "Arn": "arn:aws:kms:us-east-2:account_id:key/key_id",
        "CreationDate": "time",
        "Enabled": true,
        "Description": "",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Enabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ],
        "MultiRegion": false
    }

使用文本编辑器创建名为 bucketencryption.json 的文件，其中包含以下内容。

{
  "Rules": [
    {
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "{KMS Key ARN}"
      },
      "BucketKeyEnabled": true
    }
  ]
}

输入以下命令，将 bucket-name 替换为您要将日志导出到的桶的名称。

aws s3api put-bucket-encryption --bucket bucket-name --server-side-encryption-configuration file://bucketencryption.json

如果该命令没有返回错误，则该过程成功。