Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(cloudfront constructs): add s3 access logging to cloudfront access log buckets by default #1042

Merged
merged 3 commits into from
Dec 13, 2023
Merged

feat(cloudfront constructs): add s3 access logging to cloudfront access log buckets by default #1042

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3a20436
Add S3 Access Logging to CloudFront log buckets
biffgaut Dec 12, 2023
7a33919
Suppress cfn_nag warning
biffgaut Dec 12, 2023
e59a01b
Default to all constructs
biffgaut Dec 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
149 changes: 75 additions & 74 deletions refresh-multiple-tests.sh → deployment/v2/refresh-multiple-tests.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,82 +19,83 @@
# a sleep 10 command before the end of the loop to keep from overwhelming CloudFormation

export constructs="
aws-alb-fargate
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

was removing these intentional?

aws-alb-lambda
aws-apigateway-dynamodb
aws-apigateway-iot
aws-apigateway-kinesisstreams
aws-apigateway-lambda
aws-apigateway-sagemakerendpoint
aws-apigateway-sqs
aws-cloudfront-apigateway
aws-cloudfront-apigateway-lambda
aws-cloudfront-mediastore
aws-cloudfront-s3
aws-cognito-apigateway-lambda
aws-dynamodbstreams-lambda
aws-dynamodbstreams-lambda-elasticsearch-kibana
aws-eventbridge-kinesisfirehose-s3
aws-eventbridge-kinesisstreams
aws-eventbridge-lambda
aws-eventbridge-sns
aws-eventbridge-sqs
aws-eventbridge-stepfunctions
aws-fargate-dynamodb
aws-fargate-eventbridge
aws-fargate-kinesisfirehose
aws-fargate-kinesisstreams
aws-fargate-opensearch
aws-fargate-s3
aws-fargate-secretsmanager
aws-fargate-sns
aws-fargate-sqs
aws-fargate-ssmstringparameter
aws-fargate-stepfunctions
aws-iot-kinesisfirehose-s3
aws-iot-kinesisstreams
aws-iot-lambda
aws-iot-lambda-dynamodb
aws-iot-s3
aws-iot-sqs
aws-kinesisfirehose-s3
aws-kinesisstreams-gluejob
aws-kinesisstreams-kinesisfirehose-s3
aws-kinesisstreams-lambda
aws-lambda-dynamodb
aws-lambda-elasticachememcached
aws-lambda-elasticsearch-kibana
aws-lambda-eventbridge
aws-lambda-kendra
aws-lambda-kinesisfirehose
aws-lambda-kinesisstreams
aws-lambda-opensearch
aws-lambda-s3
aws-lambda-sagemakerendpoint
aws-lambda-secretsmanager
aws-lambda-sns
aws-lambda-sqs
aws-lambda-sqs-lambda
aws-lambda-ssmstringparameter
aws-lambda-stepfunctions
aws-openapigateway-lambda
aws-route53-alb
aws-route53-apigateway
aws-s3-lambda
aws-s3-sns
aws-s3-sqs
aws-s3-stepfunctions
aws-sns-lambda
aws-sns-sqs
aws-sqs-lambda
aws-wafwebacl-alb
aws-wafwebacl-apigateway
aws-wafwebacl-appsync
aws-wafwebacl-cloudfront
aws-alb-fargate
aws-alb-lambda
aws-apigateway-dynamodb
aws-apigateway-iot
aws-apigateway-kinesisstreams
aws-apigateway-lambda
aws-apigateway-sagemakerendpoint
aws-apigateway-sqs
aws-cloudfront-apigateway
aws-cloudfront-apigateway-lambda
aws-cloudfront-mediastore
aws-cloudfront-s3
aws-cognito-apigateway-lambda
aws-dynamodbstreams-lambda
aws-dynamodbstreams-lambda-elasticsearch-kibana
aws-eventbridge-kinesisfirehose-s3
aws-eventbridge-kinesisstreams
aws-eventbridge-lambda
aws-eventbridge-sns
aws-eventbridge-sqs
aws-eventbridge-stepfunctions
aws-fargate-dynamodb
aws-fargate-eventbridge
aws-fargate-kinesisfirehose
aws-fargate-kinesisstreams
aws-fargate-opensearch
aws-fargate-s3
aws-fargate-secretsmanager
aws-fargate-sns
aws-fargate-sqs
aws-fargate-ssmstringparameter
aws-fargate-stepfunctions
aws-iot-kinesisfirehose-s3
aws-iot-kinesisstreams
aws-iot-lambda
aws-iot-lambda-dynamodb
aws-iot-s3
aws-iot-sqs
aws-kinesisfirehose-s3
aws-kinesisstreams-gluejob
aws-kinesisstreams-kinesisfirehose-s3
aws-kinesisstreams-lambda
aws-lambda-dynamodb
aws-lambda-elasticachememcached
aws-lambda-elasticsearch-kibana
aws-lambda-eventbridge
aws-lambda-kendra
aws-lambda-kinesisfirehose
aws-lambda-kinesisstreams
aws-lambda-opensearch
aws-lambda-s3
aws-lambda-sagemakerendpoint
aws-lambda-secretsmanager
aws-lambda-sns
aws-lambda-sqs
aws-lambda-sqs-lambda
aws-lambda-ssmstringparameter
aws-lambda-stepfunctions
aws-openapigateway-lambda
aws-route53-alb
aws-route53-apigateway
aws-s3-lambda
aws-s3-sns
aws-s3-sqs
aws-s3-stepfunctions
aws-sns-lambda
aws-sns-sqs
aws-sqs-lambda
aws-wafwebacl-alb
aws-wafwebacl-apigateway
aws-wafwebacl-appsync
aws-wafwebacl-cloudfront
"

constructs_root_dir=$(cd $(dirname $0) && pwd)
source_dir="$constructs_root_dir/source"
deployment_dir=$(cd $(dirname $0) && pwd)
constructs_root_dir="$deployment_dir/../.."
source_dir="$deployment_dir/../../source"

echo "============================================================================================="
echo "aligning versions and updating package.json for CDK v2..."
Expand Down
4 changes: 4 additions & 0 deletions source/patterns/@aws-solutions-constructs/aws-cloudfront-apigateway-lambda/lib/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,10 @@ export class CloudFrontToApiGatewayToLambda extends Construct {
defaults.CheckLambdaProps(props);
// CheckCloudFrontProps() is called by internal aws-cloudfront-apigateway construct

// All our tests are based upon this behavior being on, so we're setting
// context here rather than assuming the client will set it
this.node.setContext("@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy", true);

this.lambdaFunction = defaults.buildLambdaFunction(this, {
existingLambdaObj: props.existingLambdaObj,
lambdaFunctionProps: props.lambdaFunctionProps
Expand Down
192 changes: 188 additions & 4 deletions ...udfront-apigateway-lambda/test/integ.cftaplam-customCloudfrontLoggingBucket.expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -598,10 +598,9 @@
"Name": "SetHttpSecurityHeadersc860b559e82562b55d86431c32566a0eb839407df7"
}
},
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucket2E8E3DC2": {
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A": {
"Type": "AWS::S3::Bucket",
"Properties": {
"AccessControl": "LogDeliveryWrite",
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
Expand Down Expand Up @@ -641,12 +640,197 @@
"rules_to_suppress": [
{
"id": "W35",
"reason": "This S3 bucket is used as the access logging bucket for CloudFront Distribution"
"reason": "This S3 bucket is used as the access logging bucket for another bucket"
}
]
}
}
},
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLogPolicyC05E1C71": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A"
},
"PolicyDocument": {
"Statement": [
{
"Action": "s3:*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": [
"s3:PutBucketPolicy",
"s3:GetBucket*",
"s3:List*",
"s3:DeleteObject*"
],
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderRole3B1BD092",
"Arn"
]
}
},
"Resource": [
{
"Fn::GetAtt": [
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A",
"Arn"
]
},
"/*"
]
]
}
]
},
{
"Action": "s3:PutObject",
"Condition": {
"ArnLike": {
"aws:SourceArn": {
"Fn::GetAtt": [
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucket2E8E3DC2",
"Arn"
]
}
},
"StringEquals": {
"aws:SourceAccount": {
"Ref": "AWS::AccountId"
}
}
},
"Effect": "Allow",
"Principal": {
"Service": "logging.s3.amazonaws.com"
},
"Resource": {
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A",
"Arn"
]
},
"/*"
]
]
}
}
],
"Version": "2012-10-17"
}
}
},
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLogAutoDeleteObjectsCustomResource296BC002": {
"Type": "Custom::S3AutoDeleteObjects",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"CustomS3AutoDeleteObjectsCustomResourceProviderHandler9D90184F",
"Arn"
]
},
"BucketName": {
"Ref": "cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A"
}
},
"DependsOn": [
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLogPolicyC05E1C71"
],
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucket2E8E3DC2": {
"Type": "AWS::S3::Bucket",
"Properties": {
"AccessControl": "LogDeliveryWrite",
"BucketEncryption": {
"ServerSideEncryptionConfiguration": [
{
"ServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
}
}
]
},
"LoggingConfiguration": {
"DestinationBucketName": {
"Ref": "cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A"
}
},
"OwnershipControls": {
"Rules": [
{
"ObjectOwnership": "ObjectWriter"
}
]
},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": true,
"BlockPublicPolicy": true,
"IgnorePublicAcls": true,
"RestrictPublicBuckets": true
},
"Tags": [
{
"Key": "aws-cdk:auto-delete-objects",
"Value": "true"
}
],
"VersioningConfiguration": {
"Status": "Enabled"
}
},
"UpdateReplacePolicy": "Delete",
"DeletionPolicy": "Delete"
},
"cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketPolicy416A95E3": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
Expand Down Expand Up @@ -910,7 +1094,7 @@
[
"Lambda function for auto-deleting objects in ",
{
"Ref": "cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucket2E8E3DC2"
"Ref": "cfapigwlambdaCloudFrontToApiGatewayCloudfrontLoggingBucketAccessLog48BE423A"
},
" S3 bucket."
]
Expand Down
Loading