(aws_elasticloadbalancingv2): logAccessLogs(myBucket) doesn't grant correct permissions

[ahammond]

What is the problem?

Permissions granted to the bucket policy by applicationLoadBalancer.logAccessLogs(logBucket); do not match permissions required for logging as documented at https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

Specifically, per the docs the policy needs to include

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::elb-account-id:root"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/prefix/AWSLogs/your-aws-account-id/*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "delivery.logs.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/prefix/AWSLogs/your-aws-account-id/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "delivery.logs.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::bucket-name"
    }
  ]
}

The logAccessLogs() method appears to be adding the first stanza to the bucket policy:

        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::MY_ALB_ACCOUNT_ID:root"
            },
            "Action": [
                "s3:PutObject",
                "s3:Abort*"
            ],
            "Resource": "arn:aws:s3:::app-access-logs.clickup-qa.com/AWSLogs/MY_ALB_ACCOUNT_ID/*"
        }

Workaround is

function grantLogDeliveryPrincipal(account: string, logBucket: aws_s3.Bucket): void {
  const principals = [new aws_iam.ServicePrincipal('delivery.logs.amazonaws.com')];
  // Per https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
  [
    {
      actions: ['s3:PutObject'],
      conditions: { StringEquals: { 's3:x-amz-acl': 'bucket-owner-full-control' } },
      principals,
      resources: [logBucket.arnForObjects(`AWSLogs/${account}/*`)],
    },
    {
      actions: ['s3:GetBucketAcl'],
      principals,
      resources: [logBucket.bucketArn],
    },
  ].forEach((p) => logBucket.addToResourcePolicy(new aws_iam.PolicyStatement(p)));
}

Reproduction Steps

import {
  App,
  aws_ec2,
  aws_elasticloadbalancingv2,
  aws_s3,
  Stack,
  StackProps,
} from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class MyStack extends Stack {
  constructor(scope: Construct, id: string, props: StackProps = {}) {
    super(scope, id, props);

    const vpc = new aws_ec2.Vpc(this, 'Vpc');

    const logBucket = new aws_s3.Bucket(this, 'LogBucket');
    const alb = new aws_elasticloadbalancingv2.ApplicationLoadBalancer(this, 'Alb', { vpc });
    alb.logAccessLogs(logBucket); // Expect this to do everything necessary to get logs in the bucket.
  }
}

const devEnv = {
  account: process.env.CDK_DEFAULT_ACCOUNT,
  region: process.env.CDK_DEFAULT_REGION,
};

const app = new App();

new MyStack(app, 'my-stack-dev', { env: devEnv });

app.synth();

What did you expect to happen?

I expected the policy to be correctly configured for the log bucket.

What actually happened?

Logs did not arrive in the bucket.

CDK CLI Version

2.1.0 (build f4f18b1)

Framework Version

2.1.0

Node.js Version

v16.13.1

OS

MacOS

Language

Typescript

Language Version

4.5.2

Other information

No response

[ahammond]

Interestingly that first stanza, which is generated by CDK, is coming up as follows:

        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::797873946194:root"
            },
            "Action": [
                "s3:PutObject",
                "s3:Abort*"
            ],
            "Resource": "arn:aws:s3:::app-access-logs.clickup-qa.com/AWSLogs/187416477703/*"
        },

Note that the account in the principal does not match the account id in the resource. These are both deployed in the account identified by the resource. I'm also not sure where the Abort* comes from.

[ahammond]

Ah, the different account ids is intentional and correct (I read further in the docs).

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.