How do I resolve the "Insufficient delivery policy" error in AWS Control Tower?

Short description

AWS Config and AWS CloudTrail deliver logs to an Amazon Simple Storage Service (Amazon S3) bucket and can encrypt the logs with an AWS Key Management Service (AWS KMS) key. This error occurs when the S3 bucket policy or the AWS KMS key policy doesn't grant the permissions that these services require to deliver logs.

You receive an error message similar to the following when you set up or update a landing zone, or enroll or update an account:

"Insufficient delivery policy to s3 bucket: aws-controltower-logs-111122223333-Home_Region, unable to write to bucket, provided s3 key prefix is 'o-a1b2c3d4e5', provided kms key is 'arn:aws:kms:Home_Region:444455556666:key/1234abcd-12ab-34cd-56ef-1234567890ab'."

The bucket shown in the error message and its policy depend on your landing zone version. For more information, see Monitor resource changes with AWS Config and AWS Config updates.

Resolution

To troubleshoot the error, complete each of the following sections.

Update the S3 bucket policy

The S3 bucket policy must allow the required service principals to perform s3:GetBucketAcl, s3:ListBucket, and s3:PutObject. The s3:PutObject statement must include an aws:SourceOrgID condition set to your organization ID.

In version 3.3 and earlier, one combined policy on the shared aws-controltower-logs-* bucket in the Log archive account grants both config.amazonaws.com and cloudtrail.amazonaws.com.

In version 4.0 and later, the policy is split across two buckets:

• For AWS Config, the aws-controltower-config-logs-* bucket in the Audit account grants the config.amazonaws.com service principal.
• For CloudTrail, the aws-controltower-cloudtrail-logs-* bucket in the Log archive account grants the cloudtrail.amazonaws.com service principal.

Note: If you upgraded from a version before 4.0, then CloudTrail continues to use the existing aws-controltower-logs-* bucket.

For the policy structure and the aws:SourceOrgID condition, see Amazon S3 bucket policy in the audit account.

To update the S3 bucket policy, complete the following steps:

1. Open the Amazon S3 console in the Log archive or Audit account that owns the bucket.
2. Choose your bucket, and then choose the Permissions tab.
3. In the Bucket policy section, confirm that the correct service principal has s3:GetBucketAcl, s3:ListBucket, and s3:PutObject access. Also, confirm that the s3:PutObject statement includes an aws:SourceOrgID condition set to your organization ID.
4. If a required statement is missing, then assume the AWSControlTowerExecution role in the account that owns the bucket and add the statement to the bucket policy. For more information, see Switch from a user to an IAM role (console).

Remove default retention from the S3 bucket

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

AWS Config doesn't support delivery to an S3 bucket that has S3 Object Lock with default retention activated. You can't deactivate Object Lock on a bucket, but you can remove the default retention setting. Use the Amazon S3 console or AWS CLI to remove the default retention.

Note: In version 4.0 and later, assume the AWSControlTowerExecution role from the management account to change the default retention setting. Otherwise, an AWS Control Tower mandatory control might deny the change. For more information, see Switch from a user to an IAM role (console).

To use the Amazon S3 console to remove the default retention, complete the following steps:

1. Open the Amazon S3 console in the Log archive or Audit account that owns the bucket.
2. Choose your bucket, and then choose the Properties tab.
3. In the Object Lock section, choose Edit.
4. Under Default retention, choose Disable, and then choose Save changes.

To use the AWS CLI to remove the default retention, run the following put-object-lock-configuration AWS CLI command:

aws s3api put-object-lock-configuration \
  --bucket amzn-s3-demo-bucket \
  --object-lock-configuration '{"ObjectLockEnabled": "Enabled"}'

Note: Replace amzn-s3-demo-bucket with the name of your S3 bucket.

Validate the AWS KMS key policy

If you configured AWS KMS keys for each AWS Control Tower service integration, then confirm that the key policy grants AWS Config and CloudTrail permission to use the key. The key policy must allow the config.amazonaws.com service principal to use kms:Decrypt and kms:GenerateDataKey. The policy must also allow the cloudtrail.amazonaws.com service principal to use kms:GenerateDataKey* and kms:Decrypt.

To review the full policy statements and update your key policy, see Update the KMS key policy.

To validate the AWS KMS key policy, complete the following steps:

1. Open the AWS KMS console in the management account.
2. In the navigation pane, choose Customer managed keys.
3. Select the AWS KMS keys that you use with AWS Control Tower.
4. On the Key policy tab, confirm that the policy includes statements for both service principals with the preceding permissions. If either statement is missing, then choose Edit and add the statement.

Check for SCP or RCP restrictions

Your AWS account might be subject to a service control policy (SCP) or resource control policy (RCP) in AWS Organizations. These policies can deny the Amazon S3 actions that AWS Config and CloudTrail require for log delivery. For more information, see SCP evaluation.

To check for SCP or RCP restrictions, complete the following steps:

1. Open the Organizations console.
2. In the navigation pane, choose AWS accounts.
3. In the organization hierarchy, select the entity that you want to manage. For example, select the Log archive account, Audit account, the organizational unit (OU) that contains these accounts, such as the Security OU, or the organization's root.
4. On the detail page, choose the Policies tab.
5. Review the attached and inherited SCPs and RCPs, and look for Deny statements on S3 actions such as s3:PutObject, s3:GetBucketAcl, or s3:ListBucket. If a policy blocks these actions, then scope the policy to not affect log delivery. For example, add a condition that excludes the AWS Control Tower log buckets, or the AWS Config and CloudTrail service principals, from the Deny statement. Or, you can detach the SCP or RCP from the entity instead.
6. After you update an SCP or RCP, wait a few minutes for the policy changes to propagate.

Then, set up your landing zone or enroll your account again.