Thanks in advance!
I've been stuck on this all weekend.. I'm attempting to create a cloudtrail service in cloudformation but receive this error when ran - Incorrect S3 bucket policy is detected for bucket: s3bucket-xxxxxx
Here's my code;
"s3bucket-xxxxxx": {
"Type": "AWS::S3::Bucket",
"Properties": {
"AccessControl": "Private",
"VersioningConfiguration": {
"Status": "Suspended"
}
},
"Metadata": {
"AWS::CloudFormation::Designer": {
"id": "XXXX"
}
}
},
"s3policytraillogs": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "s3bucket-xxxxxx"
},
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSCloudTrailAclCheck20150319",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::s3bucket-xxxxxx"
},
{
"Sid": "AWSCloudTrailWrite20150319",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::s3bucket-xxxxxx/AWSLogs/XXXXXXXX/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
},
"Metadata": {
"AWS::CloudFormation::Designer": {
"id": "XXXX"
}
}
},
"trailtraillogs": {
"Type": "AWS::CloudTrail::Trail",
"Properties": {
"IncludeGlobalServiceEvents": true,
"IsLogging": "true",
"S3BucketName": {
"Ref": "s3bucket-xxxxxx"
}
},
"Metadata": {
"AWS::CloudFormation::Designer": {
"id": "XXXX"
}
}
}
To fix this the resource needed to be joined up to the bucket using a reference
"Resource": [{
"Fn::Join": [ "", [
"arn:aws:s3:::", {
"Ref": "s3traillogs"
}, "/AWSLogs/XXXXXXXXXXX/*"
]
]
}],