S3 Bucket Policy Project 7: Cross-Account ALB/CloudTrail Logs

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Story

Harshad Joshi (मुंबई) व Claire Thompson (London) → Sneha Rao security bucket.

2. Cross-account का?

हे का लागतं?

Workload स्वतः audit delete नये. Logging account owns bucket; इतर accounts ला resource Allow.

• वेगळं logging account
• Service principals
• SourceAccount
• Later: deny delete

3. Policy

हे काय आहे?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowALBLogDelivery",
      "Effect": "Allow",
      "Principal": { "Service": "logdelivery.elasticloadbalancing.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::rb-central-logs-ap-south-1/alb/AWSLogs/444455556666/*",
      "Condition": {
        "StringEquals": { "aws:SourceAccount": "444455556666" }
      }
    },
    {
      "Sid": "AllowCloudTrailPut",
      "Effect": "Allow",
      "Principal": { "Service": "cloudtrail.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::rb-central-logs-ap-south-1/cloudtrail/AWSLogs/444455556666/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "444455556666",
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    },
    {
      "Sid": "AllowCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": { "Service": "cloudtrail.amazonaws.com" },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::rb-central-logs-ap-south-1"
    }
  ]
}

Line-by-line

1. ALB principal.
2. Account prefix.
3. SourceAccount.
4. Trail ACL.
5. GetBucketAcl.
6. Swap ids.

4. CLI

कसं करायचं (step by step)

aws s3api put-bucket-policy --bucket rb-central-logs-ap-south-1 --policy file://logs.json
# (empty success)

# On workload account: enable ALB access logs to s3://rb-central-logs-ap-south-1/alb
# Enable CloudTrail to s3://rb-central-logs-ap-south-1/cloudtrail

aws s3 ls s3://rb-central-logs-ap-south-1/alb/AWSLogs/444455556666/ --recursive | head
# AWSLogs/444455556666/elasticloadbalancing/ap-south-1/...

5. Allow/deny

# ALLOW — after enabling ALB logs, objects appear under alb/AWSLogs/...
aws s3 ls s3://rb-central-logs-ap-south-1/alb/AWSLogs/444455556666/ | head
# PRE elasticloadbalancing/

# DENY — random IAM user from another account without grant
aws s3 cp s3://rb-central-logs-ap-south-1/alb/secret.log - --profile other
# AccessDenied

6. ACL vs policy

ALB बहुतेक policy; CloudTrail कधी ACL. Docs प्रति service वाचा.

7. Multi-industry

Ecommerce, retail, bank, hospital.

8. AccessDenied debugging आणि Policy Simulator

AccessDenied क्रम: BPA → bucket Deny → IAM Allow → KMS → VPCe → ACL. Simulator BPA/VPC/KMS miss करू शकतो — खऱ्या CLI ने test.

# Decode
aws s3api get-bucket-policy --bucket BUCKET --query Policy --output text | python3 -m json.tool
aws s3api get-public-access-block --bucket BUCKET
aws iam simulate-principal-policy --policy-source-arn ARN \
  --action-names s3:GetObject --resource-arns arn:aws:s3:::BUCKET/key.txt
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=GetObject --max-items 5

9. Lab: cross-account logs

Org block नसेल तर ap-south-1 (Mumbai). आधी budget alert.

कसं करायचं (step by step)

1. Bucket + policy.
2. Enable ALB logs.
3. Objects appear.
4. Deny proof.

Cleanup (billing थांबवा)

1. Cleanup.
2. Trail cleanup.

10. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

11. Troubleshooting checklist

1. Region + endpoint.
2. Policy + BPA.
3. Lab user.
4. Sid binary search.
5. CloudTrail.
6. KMS test.
7. VPCe path.
8. Lock cleanup.

12. FAQ

13. Interview Q&A

14. Tips — English, मराठी आणि हिंदी

15. Policy save करण्याआधी checklist

1. Business rule एका वाक्यात.
2. Allow vs Deny-unless; Deny wins.
3. ARN shapes.
4. Condition keys.
5. BPA first.
6. Allow+deny plan.
7. Cleanup plan.
8. json.tool.

16. Policy Simulator walkthrough

Simulator identity/resource typos साठी चांगला; BPA/VPCe/KMS miss होऊ शकतात. नंतर खऱ्या path वरून CLI.

1. Simulator → user/role.
2. Action + ARN.
3. Include bucket policy.
4. CLI confirm.
5. Mismatch → layers.

17. Copy-paste runbook

# 0) Region + names
export AWS_REGION=ap-south-1
export BUCKET=rb-lab-$(date +%s)-ap-south-1

# 1) Create + show BPA
aws s3api create-bucket --bucket $BUCKET --region $AWS_REGION \
  --create-bucket-configuration LocationConstraint=$AWS_REGION
aws s3api get-public-access-block --bucket $BUCKET || true

# 2) Validate + apply policy
python3 -m json.tool policy.json >/dev/null
aws s3api put-bucket-policy --bucket $BUCKET --policy file://policy.json
aws s3api get-bucket-policy --bucket $BUCKET --query Policy --output text | python3 -m json.tool | head

# 3) Allow test + Deny test (fill per project)
# ... project-specific curls / aws s3 cp ...

# 4) Cleanup
aws s3 rm s3://$BUCKET --recursive || true
aws s3api delete-bucket-policy --bucket $BUCKET || true
aws s3api delete-bucket --bucket $BUCKET

18. Industry story bank

वरील प्रत्येक project एक industry story वापरतो. इतर industries मध्ये फक्त bucket/principal/Condition बदला.

• Healthcare: SSE-KMS + OrgID + MFA.
• Fintech: IP + HTTPS + OAC.
• EdTech: OAC only.
• Logistics: VPCe.
• Media: Object Lock.
• Retail: prefix public read.
• SaaS: prefix homes.
• Gov: OrgID + MFA + Lock.

19. AccessDenied debugging flowchart

1. Error code + request id.
2. Bucket + region.
3. BPA.
4. Explicit Deny.
5. Conditions.
6. KMS key policy.
7. OAC id.
8. VPCe path.
9. Simulator + CLI.
10. Support last.

20. PR review checklist

• Valid JSON.
• Required fields.
• No open write.
• Tests.
• Cleanup.

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.