Ravi Sir's Cards › AWS
Cross-account log bucket
This revision card explains Cross-account log bucket. It starts from the need that ALB and CloudTrail must write into a locked archive account. It describes bucket policy allows service principals (cloudtrail.amazonaws.com / ELB account) to PutObject under AWSLogs/ prefixes. The how-to section covers how to create archive bucket , then delivery statements , then enable Trail/ALB logs , then verify objects , then deny random Put. An example on the card is lucas Meyer Org trail lands in log-archive account 999… only.
Read card text
What this card says
Why do we need it?
ALB and CloudTrail must write into a locked archive account.
What is it?
Bucket policy allows service principals (cloudtrail.amazonaws.com / ELB account) to PutObject under AWSLogs/ prefixes.
AWSLogs
How to do it
Create archive bucket → delivery statements → enable Trail/ALB logs → verify objects → deny random Put.
Example
Lucas Meyer Org trail lands in log-archive account 999… only.