1 回答
- 最新
- 投票最多
- 评论最多
1
The trivial answer will be to create a logging bucket allowing different accounts to write to it via Bucket Policies. Then you enable the logging for every service to point to that bucket.
A bucket policy may be like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCrossAccountLogging",
"Effect": "Allow",
"Principal": {
"AWS": ["arn:aws:iam::ACCOUNT-ID-1:root", "arn:aws:iam::ACCOUNT-ID-2:root"]
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::your-log-bucket/*"
}
]
}
相关内容
- 已提问 8 个月前
- AWS 官方已更新 2 年前
- AWS 官方已更新 3 年前
- AWS 官方已更新 2 年前