How can I properly modify a bucket managed by control tower?

Shared answer

Hi There

You can assume the AWSControlTowerExecution Role from the Management account to update the bucket policy, but it is not recommended as it may get reverted during Control Tower updates.

If you need access to that bucket for a third party tool like an SIEM, you have 2 production-ready options:

1. Manage CloudTrail on your own outside of Control Tower.
2. Setup replication to a bucket that you control. Details below:

To replicate the CT Log Archive bucket to another bucket in the same account (Assuming no KMS encryption):

1. Create a new bucket with versioning enabled
2. Create an IAM role with the following trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

3. Add an inline permission policy to this role:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"s3:GetReplicationConfiguration",
				"s3:ListBucket"
			],
			"Resource": [
				"arn:aws:s3:::<SOURCE BUCKET NAME>"
			]
		},
		{
			"Effect": "Allow",
			"Action": [
				"s3:GetObjectVersionForReplication",
				"s3:GetObjectVersionAcl",
				"s3:GetObjectVersionTagging"
			],
			"Resource": [
				"arn:aws:s3:::<SOURCE BUCKET NAME>/*"
			]
		},
		{
			"Effect": "Allow",
			"Action": [
				"s3:ReplicateObject",
				"s3:ReplicateDelete",
				"s3:ReplicateTags"
			],
			"Resource": "arn:aws:s3:::<DESTINATION BUCKET NAME>/*"
		}
	]
}

5. Setup the replication rule following these steps: https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough1.html and choose the IAM role you created above.

If using KMS, you need to add additional permissions to the IAM role to allow KMS decryption as outlined here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html#replications