Skip to content

Commit 121e4a1

Browse files
author
Elad Ben-Israel
authored
revert: "chore(cloudfront): encryption and enforceSSL on distribution s3 loggingBucket (#18264)" (#18772)
#18271 resulted in the definition of a new bucket policy, which broke existing users that already had an implicit bucket policy created by AWS (see [docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html#AWS-logs-infrastructure-S3)). Reverts commit ad7374a in the meantime until we figure out the longer term solution. Fixes #18676 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 17dbe5f commit 121e4a1

File tree

4 files changed

+2
-124
lines changed

4 files changed

+2
-124
lines changed

Diff for: packages/@aws-cdk/aws-cloudfront/lib/distribution.ts

+1-4
Original file line numberDiff line numberDiff line change
@@ -430,10 +430,7 @@ export class Distribution extends Resource implements IDistribution {
430430
throw new Error('Explicitly disabled logging but provided a logging bucket.');
431431
}
432432

433-
const bucket = props.logBucket ?? new s3.Bucket(this, 'LoggingBucket', {
434-
encryption: s3.BucketEncryption.S3_MANAGED,
435-
enforceSSL: true,
436-
});
433+
const bucket = props.logBucket ?? new s3.Bucket(this, 'LoggingBucket');
437434
return {
438435
bucket: bucket.bucketRegionalDomainName,
439436
includeCookies: props.logIncludesCookies,

Diff for: packages/@aws-cdk/aws-cloudfront/lib/web-distribution.ts

+1-4
Original file line numberDiff line numberDiff line change
@@ -954,10 +954,7 @@ export class CloudFrontWebDistribution extends cdk.Resource implements IDistribu
954954
}
955955

956956
if (props.loggingConfig) {
957-
this.loggingBucket = props.loggingConfig.bucket || new s3.Bucket(this, 'LoggingBucket', {
958-
encryption: s3.BucketEncryption.S3_MANAGED,
959-
enforceSSL: true,
960-
});
957+
this.loggingBucket = props.loggingConfig.bucket || new s3.Bucket(this, 'LoggingBucket');
961958
distributionConfig = {
962959
...distributionConfig,
963960
logging: {

Diff for: packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-bucket-logging.expected.json

-58
Original file line numberDiff line numberDiff line change
@@ -75,67 +75,9 @@
7575
},
7676
"AnAmazingWebsiteProbably2LoggingBucket222F7CE9": {
7777
"Type": "AWS::S3::Bucket",
78-
"Properties": {
79-
"BucketEncryption": {
80-
"ServerSideEncryptionConfiguration": [
81-
{
82-
"ServerSideEncryptionByDefault": {
83-
"SSEAlgorithm": "AES256"
84-
}
85-
}
86-
]
87-
}
88-
},
8978
"UpdateReplacePolicy": "Retain",
9079
"DeletionPolicy": "Retain"
9180
},
92-
"AnAmazingWebsiteProbably2LoggingBucketPolicyE298B456": {
93-
"Type": "AWS::S3::BucketPolicy",
94-
"Properties": {
95-
"Bucket": {
96-
"Ref": "AnAmazingWebsiteProbably2LoggingBucket222F7CE9"
97-
},
98-
"PolicyDocument": {
99-
"Statement": [
100-
{
101-
"Action": "s3:*",
102-
"Condition": {
103-
"Bool": {
104-
"aws:SecureTransport": "false"
105-
}
106-
},
107-
"Effect": "Deny",
108-
"Principal": {
109-
"AWS": "*"
110-
},
111-
"Resource": [
112-
{
113-
"Fn::GetAtt": [
114-
"AnAmazingWebsiteProbably2LoggingBucket222F7CE9",
115-
"Arn"
116-
]
117-
},
118-
{
119-
"Fn::Join": [
120-
"",
121-
[
122-
{
123-
"Fn::GetAtt": [
124-
"AnAmazingWebsiteProbably2LoggingBucket222F7CE9",
125-
"Arn"
126-
]
127-
},
128-
"/*"
129-
]
130-
]
131-
}
132-
]
133-
}
134-
],
135-
"Version": "2012-10-17"
136-
}
137-
}
138-
},
13981
"AnAmazingWebsiteProbably2CFDistribution7C1CCD12": {
14082
"Type": "AWS::CloudFront::Distribution",
14183
"Properties": {

Diff for: packages/@aws-cdk/aws-cloudfront/test/integ.distribution-extensive.expected.json

-58
Original file line numberDiff line numberDiff line change
@@ -2,67 +2,9 @@
22
"Resources": {
33
"MyDistLoggingBucket9B8976BC": {
44
"Type": "AWS::S3::Bucket",
5-
"Properties": {
6-
"BucketEncryption": {
7-
"ServerSideEncryptionConfiguration": [
8-
{
9-
"ServerSideEncryptionByDefault": {
10-
"SSEAlgorithm": "AES256"
11-
}
12-
}
13-
]
14-
}
15-
},
165
"UpdateReplacePolicy": "Retain",
176
"DeletionPolicy": "Retain"
187
},
19-
"MyDistLoggingBucketPolicy847D8D11": {
20-
"Type": "AWS::S3::BucketPolicy",
21-
"Properties": {
22-
"Bucket": {
23-
"Ref": "MyDistLoggingBucket9B8976BC"
24-
},
25-
"PolicyDocument": {
26-
"Statement": [
27-
{
28-
"Action": "s3:*",
29-
"Condition": {
30-
"Bool": {
31-
"aws:SecureTransport": "false"
32-
}
33-
},
34-
"Effect": "Deny",
35-
"Principal": {
36-
"AWS": "*"
37-
},
38-
"Resource": [
39-
{
40-
"Fn::GetAtt": [
41-
"MyDistLoggingBucket9B8976BC",
42-
"Arn"
43-
]
44-
},
45-
{
46-
"Fn::Join": [
47-
"",
48-
[
49-
{
50-
"Fn::GetAtt": [
51-
"MyDistLoggingBucket9B8976BC",
52-
"Arn"
53-
]
54-
},
55-
"/*"
56-
]
57-
]
58-
}
59-
]
60-
}
61-
],
62-
"Version": "2012-10-17"
63-
}
64-
}
65-
},
668
"MyDistDB88FD9A": {
679
"Type": "AWS::CloudFront::Distribution",
6810
"Properties": {

0 commit comments

Comments
 (0)