Ошибка при создании политики сегмента S3 - значение свойства PolicyDocument должно быть объектом

Question

Я пытаюсь создать cloudTrail через приложение без сервера.

CloudTrail:
  Type: AWS::CloudTrail::Trail
  Properties: 
    # CloudWatchLogsLogGroupArn: "String"
    # CloudWatchLogsRoleArn: "String"
    # EnableLogFileValidation: True
    # EventSelectors: 
    #   - EventSelector
    # IncludeGlobalServiceEvents: True
    IsLogging: True
    # IsMultiRegionTrail: True
    # KMSKeyId: String
    S3BucketName: {"Ref" : "CloudTrailBucket"}
    # S3KeyPrefix: String
    # SnsTopicName: String
    # Tags: 
    #   - Tag
    # TrailName: String

Сначала я попытался создать cloudTrail в одиночку и получил следующую ошибку

CloudTrail - Incorrect S3 bucket policy is detected for bucket: ....

Затем я добавил этот код для создания политики

CloudTrailBucketPolicy: 
  # Version : 2012-10-17,
  Type:  AWS::S3::BucketPolicy
  Properties:
    PolicyDocument:
      - Action:
          - "s3:GetBucketAcl"
        Effect:  Allow
        Resource: { "Fn::Join": ["", ["arn:aws:s3:::CloudTrailBucket"] ] }
        Principal:  "*"
      - Action:
          - "s3:PutObject"
        Effect:  Allow
        Resource: { "Fn::Join": ["", ["arn:aws:s3:::CloudTrailBucket", "/*" ] ] }
        Principal:
          Service:  cloudtrail.amazonaws.com

Но получаюэта ошибка.

An error occurred: CloudTrailBucketPolicy - Value of property PolicyDocument must be an object.

Answer 1

Вы забыли Statement:

CloudTrailBucketPolicy: 
  # Version : 2012-10-17,
  Type:  AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref CloudTrailBucket
      PolicyDocument:
        Statement:
          - Action:
              - "s3:GetBucketAcl"
            Effect:  Allow
            Resource: { "Fn::Join": ["", ["arn:aws:s3:::", !Ref CloudTrailBucket] ] }
            Principal:  "*"
          - Action:
              - "s3:PutObject"
            Effect:  Allow
            Resource: { "Fn::Join": ["", ["arn:aws:s3:::", !Ref CloudTrailBucket, "/*" ] ] }
            Principal:
              Service:  cloudtrail.amazonaws.com