Question

我正在尝试启用帐户中所有s3存储桶的日志记录，但是在执行代码时出现错误

def s3_log():
    s3 = boto3.client('s3')
    response = s3.list_buckets()
    for i in response['Buckets']:
        #bucketacl = s3.put_bucket_acl(Bucket=i['Name'],AccessControlPolicy={'Grants': [{'Grantee': {'Type': 'Group','URI': 'http://acs.amazonaws.com/groups/s3/LogDelivery'},'Permission': 'FULL_CONTROL'}]})
        response = s3.put_bucket_logging(
        Bucket=i['Name'],
        BucketLoggingStatus={
            'LoggingEnabled': {
                'TargetBucket': i['Name'],
                'TargetGrants': [
                {
                    'Grantee': {
                        'Type': 'Group',
                        'URI': 'http://acs.amazonaws.com/groups/s3/LogDelivery'
                    },
                    'Permission': 'READ' },
                {
                    'Grantee': {
                        'Type': 'Group',
                        'URI': 'http://acs.amazonaws.com/groups/s3/LogDelivery'
                    },
                    'Permission': 'WRITE'

                },
                ],
                'TargetPrefix': i['Name'] + '/'

            }
        }

    )
Error :
"errorMessage": "An error occurred (InvalidTargetBucketForLogging) when calling the PutBucketLogging operation: You must give the log-delivery group WRITE and READ_ACP permissions to the target bucket"

我添加了目标授予来添加对日志传递组的权限，但是似乎我的代码中缺少某些内容。所以我继续尝试添加存储桶acl，但是它给了我一些格式错误的xml错误，因此acl代码是此刻发表了评论

Answer 1

您必须授予权限READ_ACP，您可以执行以下操作：

s3c.put_bucket_acl(
    AccessControlPolicy = {
        "Owner": {
            "ID": "canonical_user_id_sdakfjldsakjf" # see https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html
        },
        'Grants': [
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/s3/LogDelivery'
                },
                'Permission': 'WRITE'
            },
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/s3/LogDelivery'
                },
                'Permission': 'READ_ACP'
            }
        ]
    },
    Bucket=bucket
)

有关here

的更多信息

通过python代码启用s3存储桶日志记录

1 个答案: