☰

配置 AWS Config 以发送到一个全局 SNS 主题

tag-icon • tag-icon amazon-web-services aws-cli amazon-sns
配置 AWS Config 以发送到一个全局 SNS 主题

我正在使用 CloudCheckr.com，并按照建议在我们当前没有活动的地区启用 AWS Config。

理想情况下，我希望设置每个区域以使用来自默认区域的相同 S3 存储桶和 SNS 主题（因为它已经设置好了），但我收到了如下错误：

Last AWS Error Message: User: arn:aws:sts::XXXXXXX:assumed-role/config-role/AWSConfig-Delivery is not authorized to perform: SNS:Publish on resource: arn:aws:sns:eu-west-1:XXXXXXX:assumed:config-topic (Service: AmazonSNS; Status Code: 403; Error Code: AuthorizationError; ...

我尝试使用以下策略设置 config-role IAM 用户：

{
    "Version": "2012-10-17",
    "Statement": [{
        "Action": [
            "appstream:Get*",
            "autoscaling:Describe*",
            "cloudformation:DescribeStacks",
            "cloudformation:DescribeStackEvents",
            "cloudformation:DescribeStackResource",
            "cloudformation:DescribeStackResources",
            "cloudformation:GetTemplate",
            "cloudformation:List*",
            "cloudfront:Get*",
            "cloudfront:List*",
            "cloudtrail:DescribeTrails",
            "cloudtrail:GetTrailStatus",
            "cloudwatch:Describe*",
            "cloudwatch:Get*",
            "cloudwatch:List*",
            "config:Put*",
            "directconnect:Describe*",
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:Query",
            "dynamodb:Scan",
            "dynamodb:DescribeTable",
            "dynamodb:ListTables",
            "ec2:Describe*",
            "elasticache:Describe*",
            "elasticbeanstalk:Check*",
            "elasticbeanstalk:Describe*",
            "elasticbeanstalk:List*",
            "elasticbeanstalk:RequestEnvironmentInfo",
            "elasticbeanstalk:RetrieveEnvironmentInfo",
            "elasticloadbalancing:Describe*",
            "elastictranscoder:Read*",
            "elastictranscoder:List*",
            "iam:List*",
            "iam:Get*",
            "kinesis:Describe*",
            "kinesis:Get*",
            "kinesis:List*",
            "opsworks:Describe*",
            "opsworks:Get*",
            "route53:Get*",
            "route53:List*",
            "redshift:Describe*",
            "redshift:ViewQueriesInConsole",
            "rds:Describe*",
            "rds:ListTagsForResource",
            "s3:Get*",
            "s3:List*",
            "sdb:GetAttributes",
            "sdb:List*",
            "sdb:Select*",
            "ses:Get*",
            "ses:List*",
            "sns:Get*",
            "sns:List*",
            "sqs:GetQueueAttributes",
            "sqs:ListQueues",
            "sqs:ReceiveMessage",
            "storagegateway:List*",
            "storagegateway:Describe*",
            "trustedadvisor:Describe*"
        ],
        "Effect": "Allow",
        "Resource": "*"
    }, {
        "Effect": "Allow",
        "Action": [
            "s3:PutObject*"
        ],
        "Resource": [
            "arn:aws:s3:::config-bucket-XXXXXXXXXXXX/AWSLogs/XXXXXXXXXXXX/*"
        ],
        "Condition": {
            "StringLike": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    }, {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketAcl"
        ],
        "Resource": "arn:aws:s3:::config-bucket-XXXXXXXXXXXX"
    }, {
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXXX:config-topic"
    }]
}

但这似乎没有授予正确的权限。我不断收到：

The provided SNS topic ARN is invalid.

尽管我确信这是现有主题的正确 ARN。

以下是该 SNS ARN 的权限：

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:ListSubscriptionsByTopic",
        "SNS:Subscribe",
        "SNS:DeleteTopic",
        "SNS:GetTopicAttributes",
        "SNS:Publish",
        "SNS:RemovePermission",
        "SNS:AddPermission",
        "SNS:Receive",
        "SNS:SetTopicAttributes"
      ],
      "Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXXX:config-topic",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "XXXXXXXXXXXX"
        }
      }
    },
    {
      "Sid": "__console_pub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::XXXXXXXXXXXX:root"
        ]
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXXX:config-topic"
    },
    {
      "Sid": "__console_sub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::XXXXXXXXXXXX:root"
      },
      "Action": [
        "SNS:Subscribe",
        "SNS:Receive"
      ],
      "Resource": "arn:aws:sns:us-east-1:XXXXXXXXXXXX:config-topic"
    }
  ]
}

有人曾经这样做过吗？

甚至更好的是，是否有人有一个可以从 cli 设置区域的脚本？

答案1

从技术上讲，您可以跨区域发布 SNS 主题，但我会在您设置服务的每个区域中创建一个主题（例如，在欧盟西部的 IAM 策略中使用 eu-west-1 作为 SNS），然后将来自不同区域的所有这些消息直接发送到您选择的主区域中的单个 SQS 队列中。

如果您仍想继续沿着已经走的路走下去，您需要确保您的 IAM 角色在 SNS 发布权限中具有正确的区域（应该是 eu-west-1 而不是 us-east-1

答案2

自从对该问题的原始答案写下以来，情况可能发生了变化，因为现在在不同区域设置 SNS 主题时 AWS API 返回的错误是：

InvalidSNSTopicARNException: The sns topic arn 'arn:aws:sns:ap-southeast-2:...........' is not valid.Region provided in sns arn: ap-southeast-2, does not match the expected region: us-east-1.

这意味着 AWS Config Service 不支持发送到不同区域的 SNS 主题。

相关内容