由于 AWSSamples::S3BucketEncrypt::Hook，使用加密创建 S3 存储桶失败

Question

我已使用以下配置激活 AWSSamples::S3BucketEncrypt::Hook，但由于该挂钩，启用加密的 S3 存储桶创建似乎失败。

{
  "CloudFormationConfiguration": {
    "HookConfiguration": {
      "TargetStacks": "ALL",
      "FailureMode": "FAIL",
      "Properties": {
        "minBuckets": "1",
        "encryptionAlgorithm": "AES256"
      }
    }
  }
}

{
  "CloudFormationConfiguration": {
    "HookConfiguration": {
      "TargetStacks": "ALL",
      "FailureMode": "FAIL",
      "Properties": {
        "minBuckets": "1",
        "encryptionAlgorithm": "aws:kms"
      }
    }
  }
}

以下 CloudFormation 堆栈应该可以通过，但它们失败了。它们似乎只有在我禁用钩子时才起作用。我检查了信任策略，这对于 CloudFormation 访问钩子和 S3 存储桶来说似乎没问题。

AWSTemplateFormatVersion: 2010-09-09
Description: S3 bucket with default encryption
Resources:
  EncryptedS3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub 'encryptedbucket-${AWS::Region}-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'
    DeletionPolicy: Delete

AWSTemplateFormatVersion: "2010-09-09"
Description: This CloudFormation template provisions an encrypted S3 Bucket
Resources:
  EncryptedS3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub 'encryptedbucket-${AWS::Region}-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'aws:kms'
              KMSMasterKeyID: !Ref EncryptionKey
            BucketKeyEnabled: true
      Tags: 
        - Key: "keyname1"
          Value: "value1"

  EncryptionKey:  
    Type: AWS::KMS::Key
    Properties:
     Description: KMS key used to encrypt the resource type artifacts
     EnableKeyRotation: true
     KeyPolicy:
      Version: "2012-10-17"
      Statement:
      - Sid: Enable full access for owning account
        Effect: Allow
        Principal: 
          AWS: !Ref "AWS::AccountId"
        Action: kms:*
        Resource: "*"

Outputs:
  EncryptedBucketName:
    Value: !Ref EncryptedS3Bucket

Answer 1

存在多个问题

1. 需要使用 https://github.com/aws-cloudformation/aws-cloudformation-samples/blob/main/hooks/python-hooks/s3-bucket-encryption/hook-role.yaml
2. CF Hook配置需要为以下
3. KMS

{
  "CloudFormationConfiguration": {
    "HookConfiguration": {
      "TargetStacks": "ALL",
      "FailureMode": "FAIL",
      "Properties": {
        "minBuckets": "1",
        "encryptionAlgorithm": "aws:kms"
      }
    }
  }
}

3.1 使用以下 CF 为点 3 创建 SSE-S3 存储桶

AWSTemplateFormatVersion: "2010-09-09"
Description: This CloudFormation template provisions an encrypted S3 Bucket
Resources:
  EncryptedS3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub 'encryptedbucket-${AWS::Region}-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'aws:kms'
              KMSMasterKeyID: !Ref EncryptionKey
            BucketKeyEnabled: true
      Tags: 
        - Key: "keyname1"
          Value: "value1"

  EncryptionKey:  
    Type: AWS::KMS::Key
    Properties:
     Description: KMS key used to encrypt the resource type artifacts
     EnableKeyRotation: true
     KeyPolicy:
      Version: "2012-10-17"
      Statement:
      - Sid: Enable full access for owning account
        Effect: Allow
        Principal: 
          AWS: !Ref "AWS::AccountId"
        Action: kms:*
        Resource: "*"

Outputs:
  EncryptedBucketName:
    Value: !Ref EncryptedS3Bucket

OR

4. SSE-S3

AWSTemplateFormatVersion: 2010-09-09
Description: S3 bucket with default encryption
Resources:
 EncryptedS3Bucket:
   Type: 'AWS::S3::Bucket'
   Properties:
     BucketName: !Sub 'aesencryptedbucket-${AWS::Region}-${AWS::AccountId}'
     BucketEncryption:
       ServerSideEncryptionConfiguration:
         - ServerSideEncryptionByDefault:
             SSEAlgorithm: AES256
   DeletionPolicy: Delete

4.1 使用以下 CF 为点创建 SSE-S3 存储桶4号

AWSTemplateFormatVersion: "2010-09-09"
Description: This CloudFormation template provisions an encrypted S3 Bucket
Resources:
  EncryptedS3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub 'encryptedbucket-${AWS::Region}-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'
            BucketKeyEnabled: true
      Tags: 
        - Key: "keyname1"
          Value: "value1"

Answer 2

具有基于条件的加密的 S3 存储桶的 CloudFormation 模板是：

# version: 1.0
AWSTemplateFormatVersion: "2010-09-09"
Description: Create standardized S3 bucket using CloudFormation Template

Parameters:
  BucketName:
    Type: String
    Description: "Name of the S3 bucket"
  KMSKeyArn:
    Type: String
    Description: "KMS Key Arn to encrypt S3 bucket"
    Default: ""
  SSEAlgorithm:
    Type: String
    Description: "Encryption algorithm for KMS"
    AllowedValues:
      - aws:kms
      - AES256

Conditions:
  AES256: !Equals [!Ref SSEAlgorithm, "AES256"]

Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
        - !If
          - AES256
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
            BucketKeyEnabled: true
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
              KMSMasterKeyID: !Ref KMSKeyArn
            BucketKeyEnabled: true

使用上面的代码，您可以使用客户管理的 KMS 密钥或 AWS 托管密钥，具体取决于其使用情况，而不会导致堆栈漂移。属性 KMSMasterKeyID 不适用于 AWS 托管加密 (SSE-S3)。