如何让AWS GuardDuty将对象写入一个对未加密上传设有拒绝策略的S3存储桶？

我已经尝试了这个桶策略：

data "aws_iam_policy_document" "bucket_policy" {
  statement {
    sid    = "AllowGuardDutyValidationObject"
    effect = "Allow"
    principals {
      type        = "Service"
      identifiers = ["malware-protection-plan.guardduty.amazonaws.com"]
    }

    actions = [
      "s3:PutObject",
    ]

    resources = [
      "arn:aws:s3:::${module.s3_bucket["landing"].s3_bucket_id}/*"
    ]
  }
  statement {
    sid    = "DenyIncorrectencryptionError"
    effect = "Deny"
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions = [
      "s3:PutObject",
    ]

    not_resources = ["arn:aws:s3:::${module.s3_bucket["landing"].s3_bucket_id}/malware-protection-resource-validation-object*"]

    condition {
      test     = "StringNotEquals"
      variable = "s3:x-amz-server-side-encryption"
      values   = ["aws:kms"]
    }

    condition {
      test     = "StringNotEquals"
      variable = "aws:PrincipalService"
      values   = ["malware-protection-plan.guardduty.amazonaws.com"]
    }
  }

  statement {
    sid    = "DenyUnencryptedObjectUploads"
    effect = "Deny"
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions = [
      "s3:PutObject",
    ]

   not_resources = ["arn:aws:s3:::${module.s3_bucket["landing"].s3_bucket_id}/malware-protection-resource-validation-object*"]

    condition {
      test     = "Null"
      variable = "s3:x-amz-server-side-encryption"
      values   = ["true"]
    }

    condition {
      test     = "StringNotEquals"
      variable = "aws:PrincipalService"
      values   = ["malware-protection-plan.guardduty.amazonaws.com"]
    }
  }

  statement {
    sid    = "DenyIncorrectKMSKey"
    effect = "Deny"
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions = [
      "s3:PutObject",
    ]

    not_resources = ["arn:aws:s3:::${module.s3_bucket["landing"].s3_bucket_id}/malware-protection-resource-validation-object*"]

    condition {
      test     = "Null"
      variable = "s3:x-amz-server-side-encryption-aws-kms-key-id"
      values   = ["false"]
    }

    condition {
      test     = "StringNotEquals"
      variable = "s3:x-amz-server-side-encryption-aws-kms-key-id"
      values   = ["${aws_kms_key.gd_mp_key.arn}"]
    }

    condition {
      test     = "StringNotEquals"
      variable = "aws:PrincipalService"
      values   = ["malware-protection-plan.guardduty.amazonaws.com"]
    }
  }
}

但仍然没有成功，我收到如下错误：

将malware-protection-resource-validation-object测试对象写入此存储桶所需的IAM角色权限不足。

这是GuardDuty的 IAM角色：

{
    "Statement": [
        {
            "Action": [
                "events:RemoveTargets",
                "events:PutTargets",
                "events:PutRule",
                "events:DeleteRule"
            ],
            "Condition": {
                "StringLike": {
                    "events:ManagedBy": "malware-protection-plan.guardduty.amazonaws.com"
                }
            },
            "Effect": "Allow",
            "Resource": "arn:aws:events:*:*:rule/*",
            "Sid": "AllowManagedRuleToSendS3EventsToGuardDuty"
        },
        {
            "Action": [
                "events:ListTargetsByRule",
                "events:DescribeRule"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:events:*:*:rule/*",
            "Sid": "AllowGuardDutyToMonitorEventBridgeManagedRule"
        },
        {
            "Action": [
                "s3:PutObjectVersionTagging",
                "s3:PutObjectTagging",
                "s3:PutObject",
                "s3:PutBucketNotification",
                "s3:ListBucket",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectVersion",
                "s3:GetObjectTagging",
                "s3:GetObject",
                "s3:GetBucketNotification"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::*",
            "Sid": "AllowS3EventsAndScan"
        },
        {
            "Action": [
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Condition": {
                "StringLike": {
                    "kms:ViaService": "s3.*.amazonaws.com"
                }
            },
            "Effect": "Allow",
            "Resource": "arn:aws:kms:*:*:key/*",
            "Sid": "AllowDecryptForMalwareScan"
        }
    ],
    "Version": "2012-10-17"
}

请问有人能帮忙吗？

解决方案

在KMS密钥策略中为该服务放行后，问题已解决。

{
        "Sid" : "AllowGuardDutyMalwareProtectionUseOfKMSKey",
        "Effect" : "Allow",
        "Principal" : {
          "Service" : "malware-protection-plan.guardduty.amazonaws.com"
        },
        "Action" : [
          "kms:GenerateDataKey",
          "kms:Decrypt"
        ],
        "Resource" : ["arn:aws:s3:::${module.s3_bucket["landing"].s3_bucket_id}/*"],
        "Condition" : {
          "StringEquals" : {
            "aws:SourceAccount" : "${data.aws_caller_identity.current.account_id}"
          }
        }
      },