Hey, everyone, and welcome back.
Now into this video we are going to discuss about the considerations that you'll have to take care of
specifically while you are writing the three bucket policy for the centralized logging based on the
cross account architecture.
Now, at this stage, when we were configuring the cross account cloud trail, we had written a simple
S3 bucket policy, and this bucket policy allowed the cloud trail service to perform the put object
operation on an S3 bucket.
So this is fine.
Now, one of the challenges that you will see in this type of configuration is that any account it can
belong to you, it cannot belong to you any place account.
If someone has created a new cloud trail based trail and they have specified your S3 bucket, then the
cloud trail of that account will be able to easily add some data to your S3 bucket.
So this is one of the primary challenges while you are adding such kind of a policy, and this is the
reason why I have also referred to as a wild card based S3 bucket policy.
So in order to overcome this, you can add a conditional statement within your bucket policy.
So as a security based practice, you can add a W associated condition key to your S3 bucket policy,
and this will prevent unauthorized access to your S3 bucket.
So if you'll see in this screenshot, we had added a condition and in this condition we have a source
and here we are adding the exact area of your cloud trail.
So you have the region, you have the account number and you even have the trail name.
So in such kind of approach, no other trail will be able to add the contents to your S3 bucket.
So this is the high level overview.
Let's go ahead and try it out now for today's demo.
Again, I already have the sample S3 bucket policy available and this bucket policy, if you will see
it, has this specific condition.
And in this source herein, this is the source herein which consists of the region, which is a south
east one, which is Singapore, the account as well as the train name.
All right.
So let's do one thing.
Let's go ahead and copy this.
And within your S3 bucket, you can go to permissions.
And within here you can edit the bucket policy.
Alright, so let's remove this.
I like the new policy over here and we can save the change.
Now, one important thing that you need to note over here, in fact, let me quickly show you.
Let's go to the objects over here.
Let's open up our cloud trade logs.
Now, if you'll see in a cloud trail, you have multiple regions that are available over here.
So generally, whenever you create a trail, you have to ensure whether it is a multi region trail or
not.
So in this case, the trail that we had created is a multi region trail and this is one of the reasons
why all of the other regions cloud trade logs are also being added over here.
Now generally, whenever you go ahead and create a policy based on the source here instead of specifying
the region, you can also add a star over here so that all of the regions would be allowed.
Now, before we conclude, in order to test if our policy is really effective or not, what we can do
is from a third place account, we can go ahead and try adding this specific S3 bucket and see if the
logs are being delivered or not.
So for today's demo, I have a third place account as well.
So from the browser, I have a third place account in a third tab within.
Let's quickly open up our cloud trail service and let's try creating a new trail.
I just call it as test trail.
Within the storage location, I'll select use existing S3 bucket and within the bucket name, we'll
add the bucket name.
We'll disable the CMS.
Let's go a bit down.
We'll do a next.
We will do a next and we'll click on Create Trail.
Now, immediately, you see the trail is not getting created again.
We are getting the create trail button over here.
All right.
Now, if you go a bit up immediately, you see, we got an error stating that the S3 bucket policy might
not have adequate permission for cloud trail to access it.
Great.
So I hope with this you understood the advantages of adding a conditional statement as part of the S3
bucket policy, specifically related to cloud service.
So that's the high level overview.
And this will conclude today's video.