aws-ec2: automatic created policy for bucket already created with FlowLogDestination.toS3 conflicts with that added by CDK via bucket.enforceSSL since #18271

[psoaresgit]

What is the problem?

The AWS::S3::BucketPolicy added by #18271 since v2.9 conflicts with existing AWSLogDeliveryWrite20150319 policies automatically applied if the construct was created and deployed by CDK versions < v2.9.

CloudFormation does not allow to merge or adopt or overwrite existing bucket policies and it errors with 'The bucket policy already exists on bucket ...'.

If the above mentioned equivalent policy had been created by the CDK/CloudFormation then the secure transport policy could be added to it, but given the given the chance that existing deployments do have this policy, and given buckets with that policy automatically applied and dedicated to VPC Flow logs which allow the log delivery service to put logs do not benefit very directly by restricting that delivery to secureTransport is true (it's an AWS service delivering the logs), it might be best to not add this policy and reverse the changes in #18271.

Reproduction Steps

    const flowLog = vpc.addFlowLog('FlowLogS3', {
      destination: ec2.FlowLogDestination.toS3()
    });

What did you expect to happen?

That the bucket policy construct/resource for log delivery had already been created by the CDK/CloudFormation.

What actually happened?

The bucket policy had been automatically created and it prevented the new construct/resource from being created.

CDK CLI Version

v2.9

Framework Version

No response

Node.js Version

v16.13

OS

Linux

Language

Typescript

Language Version

No response

Other information

No response

[ryparker]

This issue description is difficult to understand but I believe I get the gist of it.

It seems like...

1. You've already deployed a custom version of the bucket policy using an older version of CDK (< v2.9).
2. chore(ec2): enforceSSL on flowLog s3 bucket #18271 was merged.
3. You are unable to update your stack with the latest CDK version because your custom policy conflicts with the new bucket policy added in chore(ec2): enforceSSL on flowLog s3 bucket #18271.

Is this accurate? Could you share any error logs? The reproducible code you provided is not enough to reproduce the issue, could you share a complete reproduction with steps?

[psoaresgit]

No, it's not a custom bucket policy - AWS puts the policy necessary if none is provided See the documentation link I provided. Any bucket created with the construct before the change in question to the CDK resulted in AWS configuring a bucket policy. Any update with the latest version of the CDK to a stack that created such a bucket will fail because CloudFormation will not replace the policy that was generated and configured by AWS with the one now being created in the CloudFormation stack.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.