MalformedPolicy: Invalid principal in policy

[andi-pangeran]

Hi,

Need help, I got this error on provisioning public-static-website to (ap-southeast-3 region) using terraform-aws-service-catalog version 0.100.0

module.cloudfront.module.access_logs[0].aws_s3_bucket_policy.bucket_policy[0]: Creating...
module.static_website.aws_s3_bucket_policy.website[0]: Modifying... [id=edo.xxxx.com]
module.static_website.aws_s3_bucket_policy.website[0]: Modifications complete after 0s [id=edo.xxxx.com]
module.cloudfront.module.access_logs[0].aws_s3_bucket_policy.bucket_policy[0]: Still creating... [10s elapsed]
module.cloudfront.module.access_logs[0].aws_s3_bucket_policy.bucket_policy[0]: Still creating... [20s elapsed]
module.cloudfront.module.access_logs[0].aws_s3_bucket_policy.bucket_policy[0]: Still creating... [30s elapsed]
module.cloudfront.module.access_logs[0].aws_s3_bucket_policy.bucket_policy[0]: Still creating... [40s elapsed]
module.cloudfront.module.access_logs[0].aws_s3_bucket_policy.bucket_policy[0]: Still creating... [50s elapsed]
╷
│ Error: Error putting S3 policy: MalformedPolicy: Invalid principal in policy
│ 	status code: 400, request id: 1SW2NGZYREGCX0YP, host id: u2nGs1sUcy3uxBIkhLr9Yu2gAkdd3ngTZmIsYUg9Mnctb5xer+Y9r2Dcig0IqQ35obzqSunQBjg=
│
│   with module.cloudfront.module.access_logs[0].aws_s3_bucket_policy.bucket_policy[0],
│   on .terraform/modules/cloudfront.access_logs/modules/private-s3-bucket/main.tf line 429, in resource "aws_s3_bucket_policy" "bucket_policy":
│  429: resource "aws_s3_bucket_policy" "bucket_policy" {
│
╵
ERRO[0086] 1 error occurred:
	* exit status 1

details input :

inputs = {
  restrict_bucket_access_to_cloudfront    = true
  create_route53_entry                    = true
  base_domain_name                        = local.account_vars.locals.domain_name.name
  website_domain_name                     = "edo.${local.account_vars.locals.domain_name.name}"
  acm_certificate_domain_name             = "${local.account_vars.locals.domain_name.name}"
  security_header_content_security_policy = "default-src 'self'; base-uri 'self'; block-all-mixed-content; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self' blob:; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline';  upgrade-insecure-requests"

  error_responses = {
    404 = {
      response_code         = 200
      response_page_path    = "index.html"
      error_caching_min_ttl = 10
    }
  }

  force_destroy = true
}

---

Tracked in ticket #109848

[Etiene]

Could you try setting var.use_cloudfront_arn_for_bucket_policy to true and let me know if you still have this issue?

[andi-pangeran]

@Etiene got same error

╷
│ Error: Error putting S3 policy: MalformedPolicy: Invalid principal in policy
│ 	status code: 400, request id: NS78MT9TTPXWT1HD, host id: 2646mozdjXUFvkjM0WX7/6vv5J/f2D7rS7xjscEFDe1STBmVzGYxMkqQW2U6z+K/V1sgikAUHZw=
│
│   with module.cloudfront.module.access_logs[0].aws_s3_bucket_policy.bucket_policy[0],
│   on .terraform/modules/cloudfront.access_logs/modules/private-s3-bucket/main.tf line 429, in resource "aws_s3_bucket_policy" "bucket_policy":
│  429: resource "aws_s3_bucket_policy" "bucket_policy" {
│
╵
ERRO[0090] 1 error occurred:
	* exit status 1
	```

[andi-pangeran]

seems like because of region not support, based on https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#access-logs-choosing-s3-bucket

can i disabled it ? not found this variable "disable_logging" on public-static-website module

Don’t choose an Amazon S3 bucket with [S3 Object Ownership](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html) set to bucket owner enforced. That setting disables ACLs for the bucket and the objects in it, which prevents CloudFront from delivering log files to the bucket.

Don't choose an Amazon S3 bucket in any of the following Regions, because CloudFront doesn't deliver standard logs to buckets in these Regions:

Africa (Cape Town)  af-south-1

Asia Pacific (Hong Kong)  ap-east-1

Asia Pacific (Jakarta)  ap-southeast-3

Europe (Milan)  eu-south-1

Middle East (Bahrain)  me-south-

[Etiene]

Oh I see. Currently, the module s3-cloudfront allows it, but var.disable_logging is not exposed to public-static-website yet. I'll open an issue on the service-catalog repo, but in the meantime you can expose that variable on your fork.

edit: link to issue: https://github.com/gruntwork-io/terraform-aws-service-catalog/issues/1789

[Etiene]

Hi @andi-pangeran,

As discussed in other replies, CloudFront doesn't deliver standard logs to buckets in some regions, and for those cases, you need to use var.disable_logging which is now exposed to module public-static-website on the service catalog as of v0.100.5:
https://github.com/gruntwork-io/terraform-aws-service-catalog/releases/tag/v0.100.5