当策略强制KMS SSE时,Logstash无法访问S3

我在许多容器化服务上运行Filebeats来收集日志并将其发送到logstash(v5.3.1)容器,该容器反过来将其上传到aws S3。

我已经使用默认kms启用了服务器端加密,可以在静止时加密日志,效果很好。然而,当我添加一个bucket策略时,如果未启用kms sse,则拒绝访问,logstash将失败,并出现错误: 错误logstash.outputs。s3-验证bucket写入权限时出错!{:message=>“拒绝访问”,:class=>“Aws::S3::Errors::AccessDenied”}

一旦我从策略中删除拒绝部分,它就会再次工作。

 output {
      s3{
        server_side_encryption           => true
        server_side_encryption_algorithm => "aws:kms"
        region => "XXXXXX"
        bucket => "XXXXX"
        prefix => "XXXXXXXX"
      }
    }

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": “Logging bucket",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::XXXXXXXXXXX:root"
                ]
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::bucket_name_12343456/*”
        },
        {
            "Sid": "DenyIncorrectEncryptionHeader",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bucket_name_12343456/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "aws:kms"
                }
            }
        },
        {
            "Sid": "DenyUnEncryptedObjectUploads",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bucket_name_12343456/*",
            "Condition": {
                "Null": {
                    "s3:x-amz-server-side-encryption": "true"
                }
            }
        }
    ]
}

奇怪的是,当我删除上面策略的Deny*部分时,它起作用了:文件被写入S3 bucket,并且它们被标记为: 服务器端加密 AWS-KMS KMS密钥ID XXXXXXXXXX