aws-cdk multi-account bucket policy - aws-cdk

Question

I have the following:
const accessLogsBucket: Bucket = new Bucket(this, 'LogsBucket', {
bucketName: `logs-${account}-${region}`,
versioned: true,
encryption: BucketEncryption.S3_MANAGED,
blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
accessControl: BucketAccessControl.LOG_DELIVERY_WRITE,
removalPolicy: RemovalPolicy.RETAIN,
});
adding an S3 bucket, to which I would like to add a Policy so that other AWS accounts are able to write to it. For example I like to add this policy:
{
"Version": "2008-10-17",
"Id": "PolicyForCombinedBucket",
"Statement": [
{
"Sid": "Set permissions for objects",
"Effect": "Allow",
"Principal": {
"AWS": ["{PayerAccountA}","{PayerAccountB}"]
},
"Action": [
"s3:ReplicateObject",
"s3:ReplicateDelete"
],
"Resource": "arn:aws:s3:::{BucketName}/*"
}
]
}
So I tried:
accessLogsBucket.addToResourcePolicy(
new PolicyStatement({
effect: Effect.ALLOW,
actions: [
"s3:ReplicateObject",
"s3:ReplicateDelete"
],
principals: [new AnyPrincipal()],
resources: [
accessLogsBucket.arnForObjects("*")
]
})
)
How can I achieve this?

Answer 1

well, you're pretty close. But I think you have some of the wrong actions and perhaps the policies backwards.
See this link for cross account access to S3 buckets, and you can replciate these policies (or similar) in CDK. Also, because you do have block public access set, your S3 bucket needs to be in a VPC that has cross access to the VPC in the other account (through access points and vpc sharing)

Answer 2

You're on the right track. Only thing is you don't want to use 'new AnyPrincipal()), you probably want:
accessLogsBucket.addToResourcePolicy(
new PolicyStatement({
effect: Effect.ALLOW,
actions: [
"s3:ReplicateObject",
"s3:ReplicateDelete"
],
principals: [
new AccountPrincipal(payerAccountA),
new AccountPrincipal(payerAccountB),
],
resources: [
accessLogsBucket.arnForObjects("*")
]
})
)
payerAccountA and payerAccountB can be set any way you see fit.
I can't say whether your actions are correct for your use case.
I'd also add you could try using cdk-iam-floyd, which allows you to create these PolicyStatement objects in a more well-defined fashion.