1개 답변
- 최신
- 최다 투표
- 가장 많은 댓글
1
The trivial answer will be to create a logging bucket allowing different accounts to write to it via Bucket Policies. Then you enable the logging for every service to point to that bucket.
A bucket policy may be like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCrossAccountLogging",
"Effect": "Allow",
"Principal": {
"AWS": ["arn:aws:iam::ACCOUNT-ID-1:root", "arn:aws:iam::ACCOUNT-ID-2:root"]
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::your-log-bucket/*"
}
]
}
관련 콘텐츠
- AWS 공식업데이트됨 2년 전