Skip to content

Commit 0eb25f2

Browse files
pahudpahud
authored
fix(cloudfront): can't create the default log bucket (#25298)
Starting from April 2023, all newly created S3 buckets by default have [S3 Block Public Access](https://aws.amazon.com/blogs/aws/amazon-s3-block-public-access-another-layer-of-protection-for-your-accounts-and-buckets/) enabled and [access control lists](https://aws.amazon.com/blogs/aws/new-simplify-access-management-for-data-stored-in-amazon-s3/) (ACLs) disabled, and this prevents the default logBucket for cloudfront to be created. This PR adds the `ObjectOwnership` property to `ObjectWriter` that allows the default log bucket to be successfully created. Reference - https://aws.amazon.com/blogs/aws/heads-up-amazon-s3-security-changes-are-coming-in-april-of-2023/ - https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#access-logs-choosing-s3-bucket Closes #25288 #25291 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 9e0a8d7 commit 0eb25f2

18 files changed

+590
-33
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-extensive.js.snapshot/cdk.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"20.0.0"}
1+
{"version":"31.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-extensive.js.snapshot/integ-distribution-extensive.assets.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "20.0.0",
2+
"version": "31.0.0",
33
"files": {
4-
"9dc2b1d91bf8dc7a564007d2b8c42cfbe1048645014b8bcda1610f778f32d174": {
4+
"d07498b95e3a0a153a16e1cc45cdd588cc73020e9f653aecbaf1cfa16a99f262": {
55
"source": {
66
"path": "integ-distribution-extensive.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "9dc2b1d91bf8dc7a564007d2b8c42cfbe1048645014b8bcda1610f778f32d174.json",
12+
"objectKey": "d07498b95e3a0a153a16e1cc45cdd588cc73020e9f653aecbaf1cfa16a99f262.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-extensive.js.snapshot/integ-distribution-extensive.template.json

+7
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@
1111
}
1212
}
1313
]
14+
},
15+
"OwnershipControls": {
16+
"Rules": [
17+
{
18+
"ObjectOwnership": "ObjectWriter"
19+
}
20+
]
1421
}
1522
},
1623
"UpdateReplacePolicy": "Retain",

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-extensive.js.snapshot/integ.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "20.0.0",
2+
"version": "31.0.0",
33
"testCases": {
44
"integ.distribution-extensive": {
55
"stacks": [

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-extensive.js.snapshot/manifest.json

+8-8
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
{
2-
"version": "20.0.0",
2+
"version": "31.0.0",
33
"artifacts": {
4-
"Tree": {
5-
"type": "cdk:tree",
6-
"properties": {
7-
"file": "tree.json"
8-
}
9-
},
104
"integ-distribution-extensive.assets": {
115
"type": "cdk:asset-manifest",
126
"properties": {
@@ -23,7 +17,7 @@
2317
"validateOnSynth": false,
2418
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2519
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/9dc2b1d91bf8dc7a564007d2b8c42cfbe1048645014b8bcda1610f778f32d174.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/d07498b95e3a0a153a16e1cc45cdd588cc73020e9f653aecbaf1cfa16a99f262.json",
2721
"requiresBootstrapStackVersion": 6,
2822
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2923
"additionalDependencies": [
@@ -65,6 +59,12 @@
6559
]
6660
},
6761
"displayName": "integ-distribution-extensive"
62+
},
63+
"Tree": {
64+
"type": "cdk:tree",
65+
"properties": {
66+
"file": "tree.json"
67+
}
6868
}
6969
}
7070
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-extensive.js.snapshot/tree.json

+42-19
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,6 @@
44
"id": "App",
55
"path": "",
66
"children": {
7-
"Tree": {
8-
"id": "Tree",
9-
"path": "Tree",
10-
"constructInfo": {
11-
"fqn": "constructs.Construct",
12-
"version": "10.1.85"
13-
}
14-
},
157
"integ-distribution-extensive": {
168
"id": "integ-distribution-extensive",
179
"path": "integ-distribution-extensive",
@@ -25,7 +17,7 @@
2517
"path": "integ-distribution-extensive/MyDist/Origin1",
2618
"constructInfo": {
2719
"fqn": "constructs.Construct",
28-
"version": "10.1.85"
20+
"version": "10.1.270"
2921
}
3022
},
3123
"LoggingBucket": {
@@ -46,18 +38,25 @@
4638
}
4739
}
4840
]
41+
},
42+
"ownershipControls": {
43+
"rules": [
44+
{
45+
"objectOwnership": "ObjectWriter"
46+
}
47+
]
4948
}
5049
}
5150
},
5251
"constructInfo": {
53-
"fqn": "@aws-cdk/aws-s3.CfnBucket",
54-
"version": "0.0.0"
52+
"fqn": "constructs.Construct",
53+
"version": "10.1.270"
5554
}
5655
}
5756
},
5857
"constructInfo": {
59-
"fqn": "@aws-cdk/aws-s3.Bucket",
60-
"version": "0.0.0"
58+
"fqn": "constructs.Construct",
59+
"version": "10.1.270"
6160
}
6261
},
6362
"Resource": {
@@ -116,26 +115,50 @@
116115
}
117116
},
118117
"constructInfo": {
119-
"fqn": "@aws-cdk/aws-cloudfront.CfnDistribution",
120-
"version": "0.0.0"
118+
"fqn": "constructs.Construct",
119+
"version": "10.1.270"
121120
}
122121
}
123122
},
124123
"constructInfo": {
125-
"fqn": "@aws-cdk/aws-cloudfront.Distribution",
126-
"version": "0.0.0"
124+
"fqn": "constructs.Construct",
125+
"version": "10.1.270"
126+
}
127+
},
128+
"BootstrapVersion": {
129+
"id": "BootstrapVersion",
130+
"path": "integ-distribution-extensive/BootstrapVersion",
131+
"constructInfo": {
132+
"fqn": "constructs.Construct",
133+
"version": "10.1.270"
134+
}
135+
},
136+
"CheckBootstrapVersion": {
137+
"id": "CheckBootstrapVersion",
138+
"path": "integ-distribution-extensive/CheckBootstrapVersion",
139+
"constructInfo": {
140+
"fqn": "constructs.Construct",
141+
"version": "10.1.270"
127142
}
128143
}
129144
},
130145
"constructInfo": {
131146
"fqn": "constructs.Construct",
132-
"version": "10.1.85"
147+
"version": "10.1.270"
148+
}
149+
},
150+
"Tree": {
151+
"id": "Tree",
152+
"path": "Tree",
153+
"constructInfo": {
154+
"fqn": "constructs.Construct",
155+
"version": "10.1.270"
133156
}
134157
}
135158
},
136159
"constructInfo": {
137160
"fqn": "constructs.Construct",
138-
"version": "10.1.85"
161+
"version": "10.1.270"
139162
}
140163
}
141164
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-logbucket.js.snapshot/LambdaTestDefaultTestDeployAssert1AF2B360.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "LambdaTestDefaultTestDeployAssert1AF2B360.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-logbucket.js.snapshot/LambdaTestDefaultTestDeployAssert1AF2B360.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-logbucket.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"31.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-logbucket.js.snapshot/integ-distribution-logbucket.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"048a9217333f79d9daa080118ffb36e6564d692917b8083547f37690586c037d": {
5+
"source": {
6+
"path": "integ-distribution-logbucket.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "048a9217333f79d9daa080118ffb36e6564d692917b8083547f37690586c037d.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-logbucket.js.snapshot/integ-distribution-logbucket.template.json

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"Resources": {
3+
"LogBucketCC3B17E8": {
4+
"Type": "AWS::S3::Bucket",
5+
"Properties": {
6+
"OwnershipControls": {
7+
"Rules": [
8+
{
9+
"ObjectOwnership": "ObjectWriter"
10+
}
11+
]
12+
}
13+
},
14+
"UpdateReplacePolicy": "Retain",
15+
"DeletionPolicy": "Retain"
16+
},
17+
"MyDistDB88FD9A": {
18+
"Type": "AWS::CloudFront::Distribution",
19+
"Properties": {
20+
"DistributionConfig": {
21+
"DefaultCacheBehavior": {
22+
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
23+
"Compress": true,
24+
"TargetOriginId": "integdistributionlogbucketMyDistOrigin16148F85F",
25+
"ViewerProtocolPolicy": "allow-all"
26+
},
27+
"Enabled": true,
28+
"HttpVersion": "http2",
29+
"IPV6Enabled": true,
30+
"Logging": {
31+
"Bucket": {
32+
"Fn::GetAtt": [
33+
"LogBucketCC3B17E8",
34+
"RegionalDomainName"
35+
]
36+
}
37+
},
38+
"Origins": [
39+
{
40+
"CustomOriginConfig": {
41+
"OriginProtocolPolicy": "https-only"
42+
},
43+
"DomainName": "www.example.com",
44+
"Id": "integdistributionlogbucketMyDistOrigin16148F85F",
45+
"OriginShield": {
46+
"Enabled": true,
47+
"OriginShieldRegion": "us-west-2"
48+
}
49+
}
50+
]
51+
}
52+
}
53+
}
54+
},
55+
"Parameters": {
56+
"BootstrapVersion": {
57+
"Type": "AWS::SSM::Parameter::Value<String>",
58+
"Default": "/cdk-bootstrap/hnb659fds/version",
59+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
60+
}
61+
},
62+
"Rules": {
63+
"CheckBootstrapVersion": {
64+
"Assertions": [
65+
{
66+
"Assert": {
67+
"Fn::Not": [
68+
{
69+
"Fn::Contains": [
70+
[
71+
"1",
72+
"2",
73+
"3",
74+
"4",
75+
"5"
76+
],
77+
{
78+
"Ref": "BootstrapVersion"
79+
}
80+
]
81+
}
82+
]
83+
},
84+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
85+
}
86+
]
87+
}
88+
}
89+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-logbucket.js.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "31.0.0",
3+
"testCases": {
4+
"LambdaTest/DefaultTest": {
5+
"stacks": [
6+
"integ-distribution-logbucket"
7+
],
8+
"assertionStack": "LambdaTest/DefaultTest/DeployAssert",
9+
"assertionStackName": "LambdaTestDefaultTestDeployAssert1AF2B360"
10+
}
11+
}
12+
}

0 commit comments

Comments
 (0)