fix(elbv2): missing permission to write NLB access logs to S3 bucket #8114
Conversation
fixes aws#8113 Currently, it's not possible to enable access logs for a network load balancer using the logAccessLogs method. Cloudformation will fail at deploy time because the S3 Bucket doesn't have the right permissions.
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
| actions: ['s3:PutObject'], | ||
| principals: [new ServicePrincipal('delivery.logs.amazonaws.com')], | ||
| resources: [ | ||
| `arn:aws:s3:::${bucket.bucketName.toString()}/${prefix ? prefix + '/' : ''}AWSLogs/${ |
There was a problem hiding this comment.
Why do we need toString here?
Can we use bucket.arnForObjects?
There was a problem hiding this comment.
@eladb , I didn't know about arnForObjects. I updated the code and the tests accordingly.
Also updated the PR title.
DaWyz
changed the title
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
| bucket.addToResourcePolicy( | ||
| new PolicyStatement({ | ||
| actions: ['s3:PutObject'], | ||
| principals: [new ServicePrincipal('delivery.logs.amazonaws.com')], |
There was a problem hiding this comment.
Assign the principal to a variable and reuse in both places
| actions: ['s3:PutObject'], | ||
| principals: [new ServicePrincipal('delivery.logs.amazonaws.com')], | ||
| resources: [ | ||
| bucket.arnForObjects(`${prefix ? prefix + '/' : ''}AWSLogs/${Stack.of(this).account}/*`), |
There was a problem hiding this comment.
I think you should be able to do this.stack.account since this is a Resource
There was a problem hiding this comment.
It does work. Updated the code.
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
fixes #8113
Currently, it's not possible to enable access logs for a network load balancer
using the logAccessLogs method. Cloudformation will fail at deploy time because
the S3 Bucket doesn't have the right permissions.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license