@@ -2,7 +2,7 @@ import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
2
2
import * as ec2 from '@aws-cdk/aws-ec2' ;
3
3
import { PolicyStatement , ServicePrincipal } from '@aws-cdk/aws-iam' ;
4
4
import { IBucket } from '@aws-cdk/aws-s3' ;
5
- import { Construct , Resource , Stack } from '@aws-cdk/core' ;
5
+ import { Construct , Resource } from '@aws-cdk/core' ;
6
6
import { BaseLoadBalancer , BaseLoadBalancerProps , ILoadBalancerV2 } from '../shared/base-load-balancer' ;
7
7
import { BaseNetworkListenerProps , NetworkListener } from './network-listener' ;
8
8
@@ -115,12 +115,14 @@ export class NetworkLoadBalancer extends BaseLoadBalancer implements INetworkLoa
115
115
public logAccessLogs ( bucket : IBucket , prefix ?: string ) {
116
116
super . logAccessLogs ( bucket , prefix ) ;
117
117
118
+ const logsDeliveryServicePrincipal = new ServicePrincipal ( 'delivery.logs.amazonaws.com' ) ;
119
+
118
120
bucket . addToResourcePolicy (
119
121
new PolicyStatement ( {
120
122
actions : [ 's3:PutObject' ] ,
121
- principals : [ new ServicePrincipal ( 'delivery.logs.amazonaws.com' ) ] ,
123
+ principals : [ logsDeliveryServicePrincipal ] ,
122
124
resources : [
123
- bucket . arnForObjects ( `${ prefix ? prefix + '/' : '' } AWSLogs/${ Stack . of ( this ) . account } /*` ) ,
125
+ bucket . arnForObjects ( `${ prefix ? prefix + '/' : '' } AWSLogs/${ this . stack . account } /*` ) ,
124
126
] ,
125
127
conditions : {
126
128
StringEquals : { 's3:x-amz-acl' : 'bucket-owner-full-control' } ,
@@ -130,7 +132,7 @@ export class NetworkLoadBalancer extends BaseLoadBalancer implements INetworkLoa
130
132
bucket . addToResourcePolicy (
131
133
new PolicyStatement ( {
132
134
actions : [ 's3:GetBucketAcl' ] ,
133
- principals : [ new ServicePrincipal ( 'delivery.logs.amazonaws.com' ) ] ,
135
+ principals : [ logsDeliveryServicePrincipal ] ,
134
136
resources : [ bucket . bucketArn ] ,
135
137
} ) ,
136
138
) ;
0 commit comments