本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# 需要额外权限 [V2] 的日志记录
一些 AWS 服务使用新的方法来发送日志。这是一种灵活的方法，可让您设置从这些服务到以下一个或多个目标的日志传输： CloudWatch 日志、Amazon S3 或 Firehose 和 X-Ray 以进行跟踪传输。
工作日志传输由三个元素组成：
+ `DeliverySource`，这是代表实际发送日志的资源的逻辑对象。
+ `DeliveryDestination`，这是代表实际传输目标的逻辑对象。
+ `Delivery`，这连接传输源与传输目标
要在支持的 AWS 服务和目标之间配置日志传输，必须执行以下操作：
+ 使用创建交付来源[PutDeliverySource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliverySource.html)。
+ 使用创建配送目的地[PutDeliveryDestination](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliveryDestination.html)。
+ 如果您要跨账户传送日志，则必须在目标账户[ PutDeliveryDestinationPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliveryDestinationPolicy.html)中使用向目标分配 IAM 策略。此策略授权创建从账户 A 中的传输源到账户 B 中的传输目标的传输。对于跨账户传输，您必须手动创建权限策略。
+ 通过使用将一个配送来源和一个配送目的地精确配对来创建配送[ CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html)。
以下各节详细介绍了在登录期间使用 V2 流程将日志传输到每种类型目标时需要具备的权限。这些权限可以授予您登录时使用的 IAM 角色。
**重要**
删除日志生成资源后，您有责任删除日志传输资源。为此，请按照以下步骤操作。
`Delivery`使用[DeleteDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteDelivery.html)操作删除。
`DeliverySource`使用[DeleteDeliverySource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteDeliverySource.html)操作删除。
如果与您刚刚删除的`DeliveryDestination``DeliverySource`关联仅用于此特定用途`DeliverySource`，则可以使用[DeleteDeliveryDestinations](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeDeliveryDestinations.html)操作将其删除。
**Contents**
+ [发送到日志的 CloudWatch 日志](AWS-logs-infrastructure-V2-CloudWatchLogs.md)
+ [发送到 Amazon S3 的日志](AWS-logs-infrastructure-V2-S3.md)
+ [Amazon S3](AWS-logs-infrastructure-V2-S3.md#AWS-logs-SSE-KMS-S3-V2)
+ [日志发送至 Firehose](AWS-logs-infrastructure-V2-Firehose.md)
+ [跟踪发送到 X-Ray](AWS-logs-infrastructure-V2-XRayTraces.md)
# 发送到日志的 CloudWatch 日志
**用户权限**
要启用向日志发送 CloudWatch 日志，您必须使用以下权限登录。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "ReadWriteAccessForLogDeliveryActions",
"Effect": "Allow",
"Action": [
"logs:GetDelivery",
"logs:GetDeliverySource",
"logs:PutDeliveryDestination",
"logs:GetDeliveryDestinationPolicy",
"logs:DeleteDeliverySource",
"logs:PutDeliveryDestinationPolicy",
"logs:CreateDelivery",
"logs:GetDeliveryDestination",
"logs:PutDeliverySource",
"logs:DeleteDeliveryDestination",
"logs:DeleteDeliveryDestinationPolicy",
"logs:DeleteDelivery",
"logs:UpdateDeliveryConfiguration"
],
"Resource": [
"arn:aws:logs:us-east-1:111122223333:delivery:*",
"arn:aws:logs:us-east-1:444455556666:delivery-source:*",
"arn:aws:logs:us-east-1:777788889999:delivery-destination:*"
]
},
{
"Sid": "ListAccessForLogDeliveryActions",
"Effect": "Allow",
"Action": [
"logs:DescribeDeliveryDestinations",
"logs:DescribeDeliverySources",
"logs:DescribeDeliveries",
"logs:DescribeConfigurationTemplates"
],
"Resource": "*"
},
{
"Sid": "AllowUpdatesToResourcePolicyCWL",
"Effect": "Allow",
"Action": [
"logs:PutResourcePolicy",
"logs:DescribeResourcePolicies",
"logs:DescribeLogGroups"
],
"Resource": [
"arn:aws:logs:us-east-1:123456789012:*"
]
}
]
}
```
------
**日志组和资源策略**
接收日志的日志组必须具有包含特定权限的资源策略。如果日志组当前没有资源策略，并且设置日志记录的用户拥有该日志组的`logs:PutResourcePolicy``logs:DescribeResourcePolicies`、和`logs:DescribeLogGroups`权限，则在您开始将日志发送到 CloudWatch Logs 时， AWS 会自动为其创建以下策略。对于新创建的订阅，资源策略是在日志组级别配置的，其最大大小为 51,200 字节。如果现有的账户级资源策略已经通过通配符授予权限，则不会创建单独的日志组级别策略。要检查特定日志组的 LogGroup 级别资源策略，请使用将`--resource-arn`参数设置为日志组 ARN 且参数设置为的`describe-resource-policies`命令。`--policy-scope` `RESOURCE`
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AWSLogDeliveryWrite20150319",
"Effect": "Allow",
"Principal": {
"Service": [
"delivery.logs.amazonaws.com"
]
},
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:us-east-1:111122223333:log-group:my-log-group:log-stream:*"
],
"Condition": {
"StringEquals": {
"aws:SourceAccount": [
"0123456789"
]
},
"ArnLike": {
"aws:SourceArn": [
"arn:aws:logs:us-east-1:111122223333:*"
]
}
}
}
]
}
```
------
日志组的资源策略限制为 51,200 字节。一旦达到此限制，AWS 就无法添加新权限。这要求客户手动修改策略，以授予`delivery.logs.amazonaws.com`服务主体对`logs:CreateLogStream`和`logs:PutLogEvents`操作的权限。客户应使用带有通配符的日志组名称前缀，例如`/aws/vendedlogs/*`并在将来创建 Future Delivery 时使用此日志组名称。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AWSLogDeliveryWrite20150319",
"Effect": "Allow",
"Principal": {
"Service": [
"delivery.logs.amazonaws.com"
]
},
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:us-east-1:111122223333:log-group:my-log-group/aws/vendedlogs/*"
],
"Condition": {
"StringEquals": {
"aws:SourceAccount": [
"0123456789"
]
},
"ArnLike": {
"aws:SourceArn": [
"arn:aws:logs:us-east-1:111122223333:*"
]
}
}
}
]
}
```
------
# 发送到 Amazon S3 的日志
**用户权限**
要启用向 Amazon S3 发送日志，您必须使用以下权限登录。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "ReadWriteAccessForLogDeliveryActions",
"Effect": "Allow",
"Action": [
"logs:GetDelivery",
"logs:GetDeliverySource",
"logs:PutDeliveryDestination",
"logs:GetDeliveryDestinationPolicy",
"logs:DeleteDeliverySource",
"logs:PutDeliveryDestinationPolicy",
"logs:CreateDelivery",
"logs:GetDeliveryDestination",
"logs:PutDeliverySource",
"logs:DeleteDeliveryDestination",
"logs:DeleteDeliveryDestinationPolicy",
"logs:DeleteDelivery",
"logs:UpdateDeliveryConfiguration"
],
"Resource": [
"arn:aws:logs:us-east-1:111122223333:delivery:*",
"arn:aws:logs:us-east-1:111122223333:delivery-source:*",
"arn:aws:logs:us-east-1:111122223333:delivery-destination:*"
]
},
{
"Sid": "ListAccessForLogDeliveryActions",
"Effect": "Allow",
"Action": [
"logs:DescribeDeliveryDestinations",
"logs:DescribeDeliverySources",
"logs:DescribeDeliveries",
"logs:DescribeConfigurationTemplates"
],
"Resource": "*"
},
{
"Sid": "AllowUpdatesToResourcePolicyS3",
"Effect": "Allow",
"Action": [
"s3:PutBucketPolicy",
"s3:GetBucketPolicy"
],
"Resource": "arn:aws:s3:::bucket-name"
}
]
}
```
------
接收日志的 S3 存储桶必须具有包含特定权限的资源策略。如果存储桶当前没有资源策略，而且设置日志记录的用户对存储桶具有 `S3:GetBucketPolicy` 和 `S3:PutBucketPolicy` 权限，那么当您开始将日志发送到 Amazon S3 时， AWS 会自动为其创建以下策略。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Id": "AWSLogDeliveryWrite20150319",
"Statement": [
{
"Sid": "AWSLogDeliveryWrite",
"Effect": "Allow",
"Principal": {
"Service": "delivery.logs.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::amzn-s3-demo-bucket/AWSLogs/account-ID/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control",
"aws:SourceAccount": [
"0123456789"
]
},
"ArnLike": {
"aws:SourceArn": [
"arn:aws:logs:us-east-1:111122223333:delivery-source:*"
]
}
}
}
]
}
```
------
在之前的策略中，对于 `aws:SourceAccount`，请指定将日志传送到此存储桶的账户 ID 列表。对于`aws:SourceArn`，在表单中指定生成日志的资源列表`arn:aws:logs:source-region:source-account-id:*`。 ARNs
如果存储桶具有资源策略，但该策略不包含上一个策略中所示的语句，并且设置日志记录的用户对存储桶具有 `S3:GetBucketPolicy` 和 `S3:PutBucketPolicy` 权限，则该语句将附加到存储桶的资源策略中。
**注意**
在某些情况下， AWS CloudTrail 如果未授予`s3:ListBucket`权限，则可能会在中看到`AccessDenied`错误`delivery.logs.amazonaws.com`。为避免 CloudTrail日志中出现这些错误，您必须向授予`s3:ListBucket`权限，`delivery.logs.amazonaws.com`并且必须包含在前面的存储桶策略中设置的`s3:GetBucketAcl`权限中显示的`Condition`参数。为方便起见，可以直接将 `AWSLogDeliveryAclCheck` 更新为 `“Action”: [“s3:GetBucketAcl”, “s3:ListBucket”]`，而不是创建一个新的 `Statement`
## Amazon S3 存储桶服务器端加密
您可以通过使用 Amazon S3 托管密钥启用服务器端加密 (SSE-S3) 或使用存储在 (SSE-KMS) 中的密钥启用服务器端加密 (SSE-KMS) 来保护 Amazon S3 存储桶中的 AWS Key Management Service 数据。 AWS KMS 有关更多信息，请参阅[使用服务器端加密保护数据](https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html)。
如果选择 SSE-S3，则不需要额外的配置。Amazon S3 处理加密密钥。
**警告**
如果您选择 SSE-KMS，则必须使用客户托管密钥，因为这种情况不支持使用 AWS 托管密钥。如果您使用 AWS 托管密钥设置加密，则日志将以不可读的格式传送。
当您使用客户托管 AWS KMS 密钥时，您可以在启用存储桶加密时指定客户托管密钥的 Amazon 资源名称 (ARN)。您必须将以下内容添加到客户托管式密钥的密钥策略（不是 S3 存储桶的存储桶策略）中，以便日志传输账户可以写入 S3 存储桶。
如果选择 SSE-KMS，则必须使用客户托管式密钥，因为此场景不支持使用 AWS 托管式密钥。当您使用客户托管 AWS KMS 密钥时，您可以在启用存储桶加密时指定客户托管密钥的 Amazon 资源名称 (ARN)。您必须将以下内容添加到客户托管式密钥的密钥策略（不是 S3 存储桶的存储桶策略）中，以便日志传输账户可以写入 S3 存储桶。
```
{
"Sid": "Allow Logs Delivery to use the key",
"Effect": "Allow",
"Principal": {
"Service": [ "delivery.logs.amazonaws.com" ]
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:SourceAccount": ["0123456789"]
},
"ArnLike": {
"aws:SourceArn": ["arn:aws:logs:us-east-1:0123456789:delivery-source:*"]
}
}
}
```
对于 `aws:SourceAccount`，请指定将日志传送到此存储桶的账户 ID 列表。对于`aws:SourceArn`，在表单中指定生成日志的资源列表`arn:aws:logs:source-region:source-account-id:*`。 ARNs
# 日志发送至 Firehose
**用户权限**
要启用向 Firehose 发送日志，您必须使用以下权限登录。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "ReadWriteAccessForLogDeliveryActions",
"Effect": "Allow",
"Action": [
"logs:GetDelivery",
"logs:GetDeliverySource",
"logs:PutDeliveryDestination",
"logs:GetDeliveryDestinationPolicy",
"logs:DeleteDeliverySource",
"logs:PutDeliveryDestinationPolicy",
"logs:CreateDelivery",
"logs:GetDeliveryDestination",
"logs:PutDeliverySource",
"logs:DeleteDeliveryDestination",
"logs:DeleteDeliveryDestinationPolicy",
"logs:DeleteDelivery",
"logs:UpdateDeliveryConfiguration"
],
"Resource": [
"arn:aws:logs:us-east-1:111122223333:delivery:*",
"arn:aws:logs:us-east-1:111122223333:delivery-source:*",
"arn:aws:logs:us-east-1:111122223333:delivery-destination:*"
]
},
{
"Sid": "ListAccessForLogDeliveryActions",
"Effect": "Allow",
"Action": [
"logs:DescribeDeliveryDestinations",
"logs:DescribeDeliverySources",
"logs:DescribeDeliveries",
"logs:DescribeConfigurationTemplates"
],
"Resource": "*"
},
{
"Sid": "AllowUpdatesToResourcePolicyFH",
"Effect": "Allow",
"Action": [
"firehose:TagDeliveryStream"
],
"Resource": [
"arn:aws:firehose:us-east-1:111122223333:deliverystream/*"
]
},
{
"Sid": "CreateServiceLinkedRole",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "arn:aws:iam::111122223333:role/aws-service-role/delivery.logs.amazonaws.com/AWSServiceRoleForLogDelivery"
}
]
}
```
------
**用于资源权限的 IAM 角色**
由于 Firehose 不使用资源策略， AWS 因此在设置要发送到 Firehose 的日志时会使用 IAM 角色。 AWS 创建名**AWSServiceRoleForLogDelivery**为的服务相关角色。此服务相关角色包括以下权限。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"firehose:PutRecord",
"firehose:PutRecordBatch",
"firehose:ListTagsForDeliveryStream"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/LogDeliveryEnabled": "true"
}
},
"Effect": "Allow"
}
]
}
```
------
此服务相关角色授予标签设置为的所有 Firehose 传送流`LogDeliveryEnabled`的权限。`true` AWS 在设置日志记录时，将此标签提供给目标传送流。
此服务相关角色还具有允许 `delivery.logs.amazonaws.com` 服务委托人来代入所需服务相关角色的信任策略。该信任策略如下所示：
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "delivery.logs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
```
------
# 跟踪发送到 X-Ray
**用户权限**
要启用向发送跟踪 AWS X-Ray，您必须使用以下权限登录。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "ReadWriteAccessForLogDeliveryActions",
"Effect": "Allow",
"Action": [
"logs:GetDelivery",
"logs:GetDeliverySource",
"logs:PutDeliveryDestination",
"logs:GetDeliveryDestinationPolicy",
"logs:DeleteDeliverySource",
"logs:PutDeliveryDestinationPolicy",
"logs:CreateDelivery",
"logs:GetDeliveryDestination",
"logs:PutDeliverySource",
"logs:DeleteDeliveryDestination",
"logs:DeleteDeliveryDestinationPolicy",
"logs:DeleteDelivery",
"logs:UpdateDeliveryConfiguration"
],
"Resource": [
"arn:aws:logs:us-east-1:111122223333:delivery:*",
"arn:aws:logs:us-east-1:111122223333:delivery-source:*",
"arn:aws:logs:us-east-1:111122223333:delivery-destination:*"
]
},
{
"Sid": "ListAccessForLogDeliveryActions",
"Effect": "Allow",
"Action": [
"logs:DescribeDeliveryDestinations",
"logs:DescribeDeliverySources",
"logs:DescribeDeliveries",
"logs:DescribeConfigurationTemplates"
],
"Resource": "*"
},
{
"Sid": "AllowUpdatesToResourcePolicyXRay",
"Effect": "Allow",
"Action": [
"xray:PutResourcePolicy",
"xray:ListResourcePolicies",
"xray:GetTraceSegmentDestination"
],
"Resource": "*"
}
]
}
```
------
**X-Ray 资源策略**
接收跟踪的目标账户必须具有包含特定权限的资源策略。当设置跟踪的用户在账户中拥有`xray:PutResourcePolicy`和`xray:ListResourcePolicies`权限时，当您开始向 X-Ray 发送跟踪时， AWS 会自动创建资源策略。创建的策略取决于源服务：
**Amazon Bedrock AgentCore resources**
AWS 为每种资源类型创建一个资源策略。该政策使用范围限于账户边界的通配符模式，涵盖账户中相同 Amazon Bedrock AgentCore 资源类型的所有资源。例如，如果启用了*Amazon Bedrock AgentCore内存*资源以进行跟踪传输，则该策略将涵盖该账户中的所有内存资源，包括将来创建的任何内存资源。
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AWSLogDeliveryWrite",
"Effect": "Allow",
"Principal": {
"Service": "delivery.logs.amazonaws.com"
},
"Action": "xray:PutTraceSegments",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:SourceAccount": "123456789012"
},
"ForAllValues:ArnLike": {
"logs:LogGeneratingResourceArns": "arn:aws:bedrock-agentcore:us-east-1:123456789012:memory/*"
},
"ArnLike": {
"aws:SourceArn": "arn:aws:logs:us-east-1:123456789012:delivery-source:*"
}
}
}
]
}
```
**其他 AWS 服务**
对于支持跟踪交付的其他服务，请 AWS 创建范围限于特定源资源的资源策略。
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AWSLogDeliveryWrite",
"Effect": "Allow",
"Principal": {
"Service": "delivery.logs.amazonaws.com"
},
"Action": "xray:PutTraceSegments",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:SourceAccount": "123456789012"
},
"ForAllValues:ArnLike": {
"logs:LogGeneratingResourceArns": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/KnowledgeBaseId"
},
"ArnLike": {
"aws:SourceArn": "arn:aws:logs:us-east-1:123456789012:delivery-source:xray-test"
}
}
}
]
}
```
**启用交易搜索**
要将跟踪发送到 X-Ray，您必须启用[事务搜索](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Enable-Lambda-TransactionSearch.html)。