Skip to content

Forwarder: add KMS permission to get log from Encrypted S3 Bucket #337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 24, 2020
Merged

Forwarder: add KMS permission to get log from Encrypted S3 Bucket #337

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7b54e1c
feat: add KMS permission to get log from Encrypted S3 Bucket
guitarrapc Aug 26, 2020
d876fdf
fix: remove none necessary permissiong
guitarrapc Sep 24, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions aws/logs_monitoring/template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -495,6 +495,10 @@ Resources:
Action:
- s3:GetObject
Resource: "*"
- Effect: Allow
Action:
- kms:Decrypt
Copy link
Contributor

@tianchu tianchu Sep 23, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@guitarrapc According to my tests, if you use the AWS managed CMK (i.e., key aws/s3), no extra permissions are required for the Forwarder to download the object. If you use a customer managed CMK, the Forwarder only needs kms:Decrypt for downloading. I guess the other kms permissions you listed are required for uploading objects to the bucket, which means they are not needed by the Forwarder? Can you confirm and update the PR if only adding kms:Decrypt works for you as well? Thanks!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That make sence. AS CloudTrail only allow CMK to encypt with SSE, I foced use my CMK.
Let me check permission at my lab.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tianchu Thanks, I've tested on my lab and confirm only kms:Decrypt is needed for downloading.
I've rebase and pushed fix.
can you review?

Resource: "*"
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Expand Down