Enabling and Centralizing S3, VPC, and Load Balancer Access Logs Across Multiple AWS Accounts

Question

I manage multiple AWS accounts and need to enable access logging for S3 buckets, VPCs, and Load Balancers. How can I configure these logs for each account and centralize them in a single "Log" account?

Giovanni Lauria · Answer

The trivial answer will be to create a logging bucket allowing different accounts to write to it via Bucket Policies.
Then you enable the logging for every service to point to that bucket.

A bucket policy may be like this:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountLogging",
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::ACCOUNT-ID-1:root", "arn:aws:iam::ACCOUNT-ID-2:root"]
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::your-log-bucket/*"
    }
  ]
}
```

Enabling and Centralizing S3, VPC, and Load Balancer Access Logs Across Multiple AWS Accounts

Relevant content