Merge pull request #44 from expel-io/TME-2253/refactor-new-cloudtrail…

…-acl-configurations

TME-2253: Update New CloudTrail ACL Configurations

README.md

@@ -91,10 +91,9 @@ Please contact your Engagement Manager if you have an existing CloudTrail with a
 | [aws_kms_key.notification_encryption_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
 | [aws_s3_bucket.cloudtrail_access_log_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
 | [aws_s3_bucket.cloudtrail_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
-| [aws_s3_bucket_acl.cloudtrail_access_log_bucket_acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
-| [aws_s3_bucket_acl.cloudtrail_bucket_acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_logging.cloudtrail_bucket_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_notification.cloudtrail_bucket_notification](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification) | resource |
+| [aws_s3_bucket_policy.cloudtrail_access_log_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
 | [aws_s3_bucket_policy.cloudtrail_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
 | [aws_s3_bucket_public_access_block.cloudtrail_access_log_bucket_public_access_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
 | [aws_s3_bucket_public_access_block.cloudtrail_bucket_public_access_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |

s3.tf

@@ -12,13 +12,6 @@ resource "aws_s3_bucket" "cloudtrail_bucket" {
   tags = local.tags
 }
 
-resource "aws_s3_bucket_acl" "cloudtrail_bucket_acl" {
-  count = var.existing_cloudtrail_bucket_name == null ? 1 : 0
-
-  bucket = aws_s3_bucket.cloudtrail_bucket[0].id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket_versioning" "cloudtrail_bucket_versioning" {
   count = var.existing_cloudtrail_bucket_name == null && var.enable_bucket_versioning ? 1 : 0
 
@@ -58,11 +51,28 @@ resource "aws_s3_bucket" "cloudtrail_access_log_bucket" {
   tags = local.tags
 }
 
-resource "aws_s3_bucket_acl" "cloudtrail_access_log_bucket_acl" {
+resource "aws_s3_bucket_policy" "cloudtrail_access_log_bucket_policy" {
   count = var.existing_cloudtrail_bucket_name == null && var.enable_bucket_access_logging ? 1 : 0
 
   bucket = aws_s3_bucket.cloudtrail_access_log_bucket[0].id
-  acl    = "log-delivery-write"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "LogDeliveryPermissions",
+        Effect = "Allow",
+        Principal = {
+          Service = "logs.amazonaws.com"
+        },
+        Action = ["s3:PutObject", "s3:GetBucketAcl"],
+        Resource = [
+          "arn:aws:s3:::${aws_s3_bucket.cloudtrail_access_log_bucket[0].id}/*",
+          "arn:aws:s3:::${aws_s3_bucket.cloudtrail_access_log_bucket[0].id}",
+        ]
+      }
+    ]
+  })
 }
 
 resource "aws_s3_bucket_versioning" "cloudtrail_access_log_bucket_versioning" {