Amazon S3 サーバーアクセスログの有効化時、自動で作成されるバケットポリシーを確認してみた

aws s3api create-bucket \
  --bucket log-source-bucket-test200 \
  --region ap-northeast-1 \
  --create-bucket-configuration LocationConstraint=ap-northeast-1

aws s3api create-bucket \
  --bucket log-destination-bucket-test200 \
  --region ap-northeast-1 \
  --create-bucket-configuration LocationConstraint=ap-northeast-1

aws s3api put-bucket-logging \
  --bucket log-source-bucket \
  --bucket-logging-status '{
    "LoggingEnabled": {
      "TargetBucket": "log-destination-bucket",
      "TargetPrefix": "access-logs/"
    }
  }'

aws s3api get-bucket-policy --bucket log-destination-bucket

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3ServerAccessLogsPolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "リソース名",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "アカウント"
                }
            }
        }
    ]
}

aws s3api put-bucket-policy \
  --bucket log-destination-bucket-test200 \
  --policy file://policy.json