aws/aws-cdk

[aws-cloudtrail] cross-account `Trail`s cannot specify SNS topic

Open

#11,387 创建于 2020年11月10日

在 GitHub 查看
 (9 评论) (2 反应) (0 负责人)TypeScript (10,710 star) (3,530 fork)batch import
@aws-cdk/aws-cloudtrailbugeffort/smallgood first issuep2

描述

Continuation of: #9013 References internal ticket

When creating a new trail using an SNS topic from secondary account (see code sample below). Trail creation fails.

const externAccountTopic = sns.Topic.fromTopicArn(
   this, 
   'TopicName',
   'TOPIC_ARN_SECONDARY_ACCOUNT'
);

const multiAccountTrail = new cloudtrail.Trail(this, 'MultiAccountTrail', {
   bucket: dataEventTrailBucket,
   enableFileValidation: true,
   isMultiRegionTrail: true,
   snsTopic: externAccountTopic,
   trailName: 'MultiAccountTrail'
});

Fails with exception:

"SNS Topic does not exist or the topic policy is incorrect! (Service: AWSCloudTrail; Status Code: 400; Error Code: InsufficientSnsTopicPolicyException; Request ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx; Proxy: null)"

Related Issue

It looks like this was brought-up before, and largely addressed (initial concern was multi-region), but not fixed for multi-account.

Original Issue: #9013 Fixing PR: #9239

Environment

  • CDK CLI Version : 1.72.0
  • Framework Version: 1.72.0
  • Node.js Version: 12.16.2
  • OS : OSX Catalina
  • Language (Version): Typescript

Other

This is :bug: Bug Report

贡献者指南

技术栈
typescriptaws
领域
infrastructurecloud
议题类型
bug
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
1-2 days
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
stale
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
AWS CloudTrailSNS topic policiescross account IAMAWS CDK constructs
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
25
研究方向
Review the existing PR #9239 that addressed multi region SNS topic for trails to understand the pattern. Examine the CloudTrail L2 construct in packages/@aws cdk/aws cloudtrail/lib/trail.ts. The fix likely requires adding a topic policy resource for cross account scenarios, similar to the multi region fix but with account ID instead of region. Check if the SNS topic fromTopicArn method returns a topic that allows cross account access by default; if not, the trail construct must add a policy statement granting CloudTrail service permission to publish from the secondary account.