save flow log to a different account

Question

Hello all,
I am having issue with saving a flog log from account1 to an s3 bucket in account2, i have looked round and was not able to find a way to do that, when I try to set it up I get this error: "Method not allowed for LogDestination:  Please check LogDestination permission"

on the s3 bucket for account 2 i have:

```
{
    "Version": "2012-10-17",
    "Id": "Policy1",
    "Statement": [
        {
            "Sid": "writeflow",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam:::root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::"
        }
    ]
}
```

and have also tried on the s3 bucket:
Access for other AWS accounts
Grantee: full access

just setting up full access for the moment and once i get it working i'll reduce the permissions.

AWS-User-6550659 · Accepted Answer

Hi all, we finally got it working with the below script, just replace the 123412341234 with the account sending the flow long. E.G. 1234-1234-1234 to 123412341234

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSLogDeliveryWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": [
                "arn:aws:s3:::s3bucketname",
                "arn:aws:s3:::s3bucketname/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123412341234",
                    "s3:x-amz-acl": "bucket-owner-full-control"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:logs:ap-southeast-2:123412341234:*"
                }
            }
        },
        {
            "Sid": "AWSLogDeliveryCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": [
                "s3:GetBucketAcl",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::s3bucketname",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123412341234"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:logs:ap-southeast-2:123412341234:*"
                }
            }
        }
    ]
}
```

Sri · Answer

Please try this

1. Replace `[Account1]`, `[Account2]` with your account numbers
2. Replace the bucket name as well

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSLogDeliveryWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": [
                "arn:aws:s3:::testflowlogs84763",
                "arn:aws:s3:::testflowlogs84763/*",
                "arn:aws:s3:::testflowlogs84763/AWSLogs/[Account1]/*"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceAccount": [
                        "[Account2]",
                        "[Account1]"
                    ]
                },
                "ArnLike": {
                    "aws:SourceArn": [
                        "arn:aws:logs:ap-southeast-2:[Account2]:*",
                        "arn:aws:logs:ap-southeast-2:[Account1]:*"
                    ]
                }
            }
        },
        {
            "Sid": "AWSLogDeliveryCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": [
                "s3:GetBucketAcl",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::testflowlogs84763",
                "arn:aws:s3:::testflowlogs84763/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "[Account2]"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:logs:ap-southeast-2:[Account2]:*"
                }
            }
        },
        {
            "Sid": "AWSLogDeliveryAclCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::testflowlogs84763",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "[Account1]"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:logs:ap-southeast-2:[Account1]:*"
                }
            }
        }
    ]
}
```

Karthikeyan Venkatraman · Answer

Hi AWS-User-6550659,

I hope you are trying to send VPC flow logs to S3 destination which is located in a different AWS account. As per my understanding, you are seeing issues with the pushing flow logs to S3 from different account. For this scenario to work, S3 has to allow,{"Service": "delivery.logs.amazonaws.com"}.

Hope the below article might of some help here.

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-permissions

Happy to help.

Sri · Answer

Here is the blog article, hope this helps!

https://dev.to/kasukur/how-to-publish-vpc-flow-logs-to-a-different-account-1ead

Sri

Sri · Answer

ARN `my-s3-arn/arn:aws:s3:::bucket_name` seems to be incorrect in the policy as per the error, could you please check again?
An example ARN `arn:aws:s3:::s3bucketname`

Sri · Answer

Hello,

I think I understand your issue. Please use the following policy.

1. The issue was with `"Resource": "my-s3-arn",` as the error message says `Action does not apply to any resource(s) in statement`.  so we need to correct the Resource ARN.
S3 buckets require one ARN at the bucket level and another one for all the objects in the bucket.

```
"Resource": [
				"arn:aws:s3:::testflowlogs84763",
				"arn:aws:s3:::testflowlogs84763/*"
			],
```

2. In addition, please turn off `Block public access (bucket settings)` as we are providing access through a bucket policy

3. I used `ap-south-east-2` region and please replace `[SoureAccount]` with the account from where the flow logs will be generated

```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "AWSLogDeliveryWrite",
			"Effect": "Allow",
			"Principal": {
				"Service": "delivery.logs.amazonaws.com"
			},
			"Action": "s3:PutObject",
			"Resource": [
				"arn:aws:s3:::testflowlogs84763",
				"arn:aws:s3:::testflowlogs84763/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:SourceAccount": "[SoureAccount]",
					"s3:x-amz-acl": "bucket-owner-full-control"
				},
				"ArnLike": {
					"aws:SourceArn": "arn:aws:logs:ap-southeast-2:[SoureAccount]:*"
				}
			}
		},
		{
			"Sid": "AWSLogDeliveryCheck",
			"Effect": "Allow",
			"Principal": {
				"Service": "delivery.logs.amazonaws.com"
			},
			"Action": [
				"s3:GetBucketAcl",
				"s3:ListBucket"
			],
			"Resource": [
				"arn:aws:s3:::testflowlogs84763",
				"arn:aws:s3:::testflowlogs84763/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:SourceAccount": "[SoureAccount]"
				},
				"ArnLike": {
					"aws:SourceArn": "arn:aws:logs:ap-southeast-2:[SoureAccount]:*"
				}
			}
		}
	]
}
```

Please accept as Answer if this works for you or let me know if you need further help

Sri

save flow log to a different account

Add your answer

Relevant content