使用 Amazon CLI 将日志数据导出到 Amazon S3

创建角色并分配权限

1. 输入以下命令以创建 IAM 角色。

   aws iam create-user --user-name CWLExportUser

2. 将 IAM 托管策略附加到您刚刚创建的 IAM 用户。

   export S3POLICYARN=$(aws iam list-policies --query 'Policies[?PolicyName==`AmazonS3FullAccess`].{ARN:Arn}' --output text)

   export CWLPOLICYARN=$( aws iam list-policies --query 'Policies[?PolicyName==`CloudWatchLogsFullAccess`].{ARN:Arn}' --output text)

   aws iam attach-user-policy --user-name CWLExportUser --policy-arn $S3POLICYARN

   aws iam attach-user-policy --user-name CWLExportUser --policy-arn $CWLPOLICYARN

3. 确认已附加两个托管策略。

   aws iam list-attached-user-policies --user-name CWLExportUser

4. 将 Amazon CLI 配置为包含 CWLExportUser IAM 用户的 IAM 凭证。有关更多信息，请参阅配置 Amazon CLI。

设置 Amazon S3 存储桶上的权限

1. 创建一个名为 policy.json 的文件并添加以下访问策略，将 Resource 更改为您的 S3 存储桶的名称，并将 Principal 更改为您要将日志数据导出到的区域的终端节点。使用文本编辑器以创建此策略文件。请勿使用 IAM 控制台。

   • 如果存储桶位于您的账户中，请使用以下策略。

     {
         "Version": "2012-10-17",
         "Statement": [
             {
                 "Action": "s3:GetBucketAcl",
                 "Effect": "Allow",
                 "Resource": "arn:aws:s3:::my-exported-logs",
                 "Principal": { "Service": "logs.us-east-2.amazonaws.com" }
             },
             {
                 "Action": "s3:PutObject" ,
                 "Effect": "Allow",
                 "Resource": "arn:aws:s3:::my-exported-logs/*",
                 "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } },
                 "Principal": { "Service": "logs.us-east-2.amazonaws.com" }
             }
         ]
     }

   • 如果存储桶位于其他账户中，请改用以下策略。它使用您在上一步中创建的 IAM 用户来包括附加语句。

     {
         "Version": "2012-10-17",
         "Statement": [
           {
               "Action": "s3:GetBucketAcl",
               "Effect": "Allow",
               "Resource": "arn:aws:s3:::my-exported-logs",
               "Principal": { "Service": "logs.us-east-2.amazonaws.com" }
           },
           {
               "Action": "s3:PutObject" ,
               "Effect": "Allow",
               "Resource": "arn:aws:s3:::my-exported-logs/random-string/*",
               "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } },
               "Principal": { "Service": "logs.us-east-2.amazonaws.com" }
           },
           {
               "Action": "s3:PutObject" ,
               "Effect": "Allow",
               "Resource": "arn:aws:s3:::my-exported-logs/random-string/*",
               "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } },
               "Principal": { "AWS": "arn:aws:iam::SendingAccountID:user/CWLExportUser" }
           }
         ]
     }

   • 如果存储桶位于其他账户中，并且您使用的是 IAM 角色而不是 IAM 用户，请改用以下策略。

     {
         "Version": "2012-10-17",
         "Statement": [
           {
               "Action": "s3:GetBucketAcl",
               "Effect": "Allow",
               "Resource": "arn:aws:s3:::my-exported-logs",
               "Principal": { "Service": "logs.us-east-2.amazonaws.com" }
           },
           {
               "Action": "s3:PutObject" ,
               "Effect": "Allow",
               "Resource": "arn:aws:s3:::my-exported-logs/random-string/*",
               "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } },
               "Principal": { "Service": "logs.us-east-2.amazonaws.com" }
           },
           {
               "Action": "s3:PutObject" ,
               "Effect": "Allow",
               "Resource": "arn:aws:s3:::my-exported-logs/random-string/*",
               "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } },
               "Principal": { "AWS": "arn:aws:iam::SendingAccountID:role/CWLExportUser" }
           }
         ]
     }

2. 使用 put-bucket-policy 命令将您刚添加的策略设置为存储桶上的访问策略。此策略可让 CloudWatch Logs 将日志数据导出到您的 Amazon S3 存储桶中。存储桶拥有者将对所有导出的对象拥有完全权限。

   aws s3api put-bucket-policy --bucket my-exported-logs --policy file://policy.json

   警告

   如果现有存储桶已附加一个或多个策略，请将 CloudWatch Logs 访问的语句添加到这些策略。我们建议您评估生成的权限集，确保它们适合访问存储桶的用户。