save flow log to a different account

Question

Hello all,
I am having issue with saving a flog log from account1 to an s3 bucket in account2, i have looked round and was not able to find a way to do that, when I try to set it up I get this error: "Method not allowed for LogDestination:  Please check LogDestination permission"

on the s3 bucket for account 2 i have:

```
{
    "Version": "2012-10-17",
    "Id": "Policy1",
    "Statement": [
        {
            "Sid": "writeflow",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam:::root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::"
        }
    ]
}
```

and have also tried on the s3 bucket:
Access for other AWS accounts
Grantee: full access

just setting up full access for the moment and once i get it working i'll reduce the permissions.

Accepted Answer

Hi all, we finally got it working with the below script, just replace the 123412341234 with the account sending the flow long. E.G. 1234-1234-1234 to 123412341234

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSLogDeliveryWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": [
                "arn:aws:s3:::s3bucketname",
                "arn:aws:s3:::s3bucketname/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123412341234",
                    "s3:x-amz-acl": "bucket-owner-full-control"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:logs:ap-southeast-2:123412341234:*"
                }
            }
        },
        {
            "Sid": "AWSLogDeliveryCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": [
                "s3:GetBucketAcl",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::s3bucketname",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123412341234"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:logs:ap-southeast-2:123412341234:*"
                }
            }
        }
    ]
}
```

Answer

ARN `my-s3-arn/arn:aws:s3:::bucket_name` seems to be incorrect in the policy as per the error, could you please check again?
An example ARN `arn:aws:s3:::s3bucketname`

Answer

Here is the blog article, hope this helps!

https://dev.to/kasukur/how-to-publish-vpc-flow-logs-to-a-different-account-1ead

Sri

Answer

Hi AWS-User-6550659,

I hope you are trying to send VPC flow logs to S3 destination which is located in a different AWS account. As per my understanding, you are seeing issues with the pushing flow logs to S3 from different account. For this scenario to work, S3 has to allow,{"Service": "delivery.logs.amazonaws.com"}.

Hope the below article might of some help here.

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-permissions

Happy to help.

Answer

Hello,

I think I understand your issue. Please use the following policy.

1. The issue was with `"Resource": "my-s3-arn",` as the error message says `Action does not apply to any resource(s) in statement`.  so we need to correct the Resource ARN.
S3 buckets require one ARN at the bucket level and another one for all the objects in the bucket.

```
"Resource": [
				"arn:aws:s3:::testflowlogs84763",
				"arn:aws:s3:::testflowlogs84763/*"
			],
```

2. In addition, please turn off `Block public access (bucket settings)` as we are providing access through a bucket policy

3. I used `ap-south-east-2` region and please replace `[SoureAccount]` with the account from where the flow logs will be generated

```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "AWSLogDeliveryWrite",
			"Effect": "Allow",
			"Principal": {
				"Service": "delivery.logs.amazonaws.com"
			},
			"Action": "s3:PutObject",
			"Resource": [
				"arn:aws:s3:::testflowlogs84763",
				"arn:aws:s3:::testflowlogs84763/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:SourceAccount": "[SoureAccount]",
					"s3:x-amz-acl": "bucket-owner-full-control"
				},
				"ArnLike": {
					"aws:SourceArn": "arn:aws:logs:ap-southeast-2:[SoureAccount]:*"
				}
			}
		},
		{
			"Sid": "AWSLogDeliveryCheck",
			"Effect": "Allow",
			"Principal": {
				"Service": "delivery.logs.amazonaws.com"
			},
			"Action": [
				"s3:GetBucketAcl",
				"s3:ListBucket"
			],
			"Resource": [
				"arn:aws:s3:::testflowlogs84763",
				"arn:aws:s3:::testflowlogs84763/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:SourceAccount": "[SoureAccount]"
				},
				"ArnLike": {
					"aws:SourceArn": "arn:aws:logs:ap-southeast-2:[SoureAccount]:*"
				}
			}
		}
	]
}
```

Please accept as Answer if this works for you or let me know if you need further help

Sri

Answer

Please try this

1. Replace `[Account1]`, `[Account2]` with your account numbers
2. Replace the bucket name as well

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSLogDeliveryWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": [
                "arn:aws:s3:::testflowlogs84763",
                "arn:aws:s3:::testflowlogs84763/*",
                "arn:aws:s3:::testflowlogs84763/AWSLogs/[Account1]/*"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceAccount": [
                        "[Account2]",
                        "[Account1]"
                    ]
                },
                "ArnLike": {
                    "aws:SourceArn": [
                        "arn:aws:logs:ap-southeast-2:[Account2]:*",
                        "arn:aws:logs:ap-southeast-2:[Account1]:*"
                    ]
                }
            }
        },
        {
            "Sid": "AWSLogDeliveryCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": [
                "s3:GetBucketAcl",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::testflowlogs84763",
                "arn:aws:s3:::testflowlogs84763/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "[Account2]"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:logs:ap-southeast-2:[Account2]:*"
                }
            }
        },
        {
            "Sid": "AWSLogDeliveryAclCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::testflowlogs84763",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "[Account1]"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:logs:ap-southeast-2:[Account1]:*"
                }
            }
        }
    ]
}
```

save flow log to a different account

Relevant content