How do I update an S3 bucket policy managed by Control Tower that has SCP blocking bucket policy changes?

Hi, it is possible to modify the S3 bucket policy. But you must use the Control Tower role to do it, as the SCP allows an exception for that role.

To use it, you will need to login to the Org Management account first, where Control Tower is deployed. Then in the top right user menu, use the Switch Role function. Input the Account ID of the log archive account. In IAM Role Name use AWSControlTowerExecution. This will allow you to assume that role in the required account. And as mentioned is provided an exception in the SCP preventing changes to the S3 bucket policy.

Just remember to not remove any other part of the S3 bucket policy, as you may prevent Control Tower from operating normally (Cloudtrail and AWS Config being able to write to the bucket).

Hi There

I don't recommend modifying the CT logs bucket policy using the AWSControlTowerExecutionRole. It may get reverted during Control Tower updates.

You do not need to change the source bucket policy or destination bucket policy to setup replication. to another bucket in the same account. If replication is not working, there could be a few reasons including incorrect trust policy or permission policy attached to the IAM role used for replication, or if you are using KMS encryption, incorrect KMS permissions.

To replicate the CT Log Archive bucket to another bucket in the same account (Assuming no KMS encryption):

1. Create a new bucket with versioning enabled
2. Create an IAM role with the following trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

3. Add an inline permission policy to this role:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"s3:GetReplicationConfiguration",
				"s3:ListBucket"
			],
			"Resource": [
				"arn:aws:s3:::<SOURCE BUCKET NAME>"
			]
		},
		{
			"Effect": "Allow",
			"Action": [
				"s3:GetObjectVersionForReplication",
				"s3:GetObjectVersionAcl",
				"s3:GetObjectVersionTagging"
			],
			"Resource": [
				"arn:aws:s3:::<SOURCE BUCKET NAME>/*"
			]
		},
		{
			"Effect": "Allow",
			"Action": [
				"s3:ReplicateObject",
				"s3:ReplicateDelete",
				"s3:ReplicateTags"
			],
			"Resource": "arn:aws:s3:::<DESTINATION BUCKET NAME>/*"
		}
	]
}

3. Setup the replication rule following these steps: https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough1.html and choose the IAM role you created above.

If using KMS, you need to add additional permissions to the IAM role to allow KMS decryption as outlined here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html#replications

May I suggest, instead of the replicating the data to another S3 bucket, you just provide read-only access to your S3 from the external service. This is cheaper and faster.