[aws-cloudfront] logging bucket defined using url and not bucket name

[jtaylor-foodhub]

When deploying a CloudFrontWebDistribution with an existing bucket, the deployed configuration's Logging.Bucket is the FQDN of the bucket and not the bucket name.

Reproduction Steps

interface Props {
  logBucket: IBucket;
}

...

     this.cloudfrontDistro = new CloudFrontWebDistribution(this, "distro", {
        ...
        loggingConfig: {
          bucket: props.logBucket,
          includeCookies: true,
          prefix: `dev/cloudfront/`,
        },
        originConfigs: [
          ...
      });
    }

What did you expect to happen?

Logging bucket is specified by name:

aws cloudfront get-distribution --id XXXXXXXXXX
...
            "Logging": {
                "Enabled": true,
                "IncludeCookies": true,
                "Bucket": "my-bucket-name",
                "Prefix": "dev/cloudfront/"
            },
...

What actually happened?

Logging bucket is specified by name:

aws cloudfront get-distribution --id XXXXXXXXXX
...
            "Logging": {
                "Enabled": true,
                "IncludeCookies": true,
                "Bucket": "my-bucket-name.s3.eu-west-2.amazonaws.com",
                "Prefix": "dev/cloudfront/"
            },
...

In addition, logs never appear in this bucket. Even after a few days.

Environment

• CLI Version : 1.63.0 (build 7a68125)
• Framework Version:
• Node.js Version: v12.14.1
• OS : MacOS 10.15.6 (19G2021)
• Language (Version): TypeScript (3.9.7)

Other

---

This is 🐛 Bug Report

[jtaylor-foodhub]

When I click through to the logging bucket from the distro in the console I get this...

[njlynch]

Thanks for the bug report.

This actually seems a bit like a quirk in how the console(s) handle regional vs global S3 bucket domains, but it's a pretty easy (and non-invasive) change to fix.

Per the CloudFormation docs, the Bucket property should be:

The Amazon S3 bucket to store the access logs in, for example, myawslogbucket.s3.amazonaws.com.

This is the domain name of the bucket, whereas the CloudFront CDK constructs today are using the regional domain name. Logging still works with this configuration, but this new CloudFront Logs section of the console isn't handling the link well. For your last screenshot, if you go to https://console.aws.amazon.com/s3/buckets/_REDACTED_/?region=us-east-1 instead of https://console.aws.amazon.com/s3/buckets/_REDACTED_.eu-west-2.amazonaws.com/?region=us-east-1, you should see the logs. I was able to reproduce this with a distribution, where I saw the link from the CloudFront console go to an unknown bucket/bad data, but dropping the suffix showed the correct bucket with the logs present.

So while everything's technically working here, it does seem CloudFront is expecting the global -- not the regional -- bucket domain, and fixing it will make the console experience a bit smoother.

[zxkane]

Looks like it’s not all partitions CloudFront allowing the global s3 domain name. My CDK app met below error after upgrading to 1.68.0 in China region(cn-northwest-1),

4:04:39 PM | UPDATE_FAILED        | AWS::CloudFront::Distribution                   | CloudFrontDist/CFDistribution
The parameter Logging Bucket is invalid. The bucket is in a Region that you cannot send logs to with this distribution. (Service: AmazonCloudF
ront; Status Code: 400;

The fix introduces a regression bug to break the CloudFront distribution with logging bucket.

Thanks for the bug report.

This actually seems a bit like a quirk in how the console(s) handle regional vs global S3 bucket domains, but it's a pretty easy (and non-invasive) change to fix.

Per the CloudFormation docs, the Bucket property should be:

The Amazon S3 bucket to store the access logs in, for example, myawslogbucket.s3.amazonaws.com.

This is the domain name of the bucket, whereas the CloudFront CDK constructs today are using the regional domain name. Logging still works with this configuration, but this new CloudFront Logs section of the console isn't handling the link well. For your last screenshot, if you go to https://console.aws.amazon.com/s3/buckets/_REDACTED_/?region=us-east-1 instead of https://console.aws.amazon.com/s3/buckets/_REDACTED_.eu-west-2.amazonaws.com/?region=us-east-1, you should see the logs. I was able to reproduce this with a distribution, where I saw the link from the CloudFront console go to an unknown bucket/bad data, but dropping the suffix showed the correct bucket with the logs present.

So while everything's technically working here, it does seem CloudFront is expecting the global -- not the regional -- bucket domain, and fixing it will make the console experience a bit smoother.