Skip to content

Commit 42ef507

Browse files
watany-devwatany-dev
authored
feat(logs): add grantRead function to LogGroup (#23280)
fixes #21668 adding method `logGroup.grantRead` We refer to the following suspended PRs #22132 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Construct Runtime Dependencies: * [ ] This PR adds new construct runtime dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-construct-runtime-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent f56cb70 commit 42ef507

12 files changed

+500
-1
lines changed

‎packages/@aws-cdk/aws-logs/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,13 @@ const logGroup = new logs.LogGroup(this, 'LogGroup');
7171
logGroup.grantWrite(new iam.ServicePrincipal('es.amazonaws.com'));
7272
```
7373

74+
Similarily, read permissions can be granted to the log group as follows.
75+
76+
```ts
77+
const logGroup = new logs.LogGroup(this, 'LogGroup');
78+
logGroup.grantRead(new iam.ServicePrincipal('es.amazonaws.com'));
79+
```
80+
7481
Be aware that any ARNs or tokenized values passed to the resource policy will be converted into AWS Account IDs.
7582
This is because CloudWatch Logs Resource Policies do not accept ARNs as principals, but they do accept
7683
Account ID strings. Non-ARN principals, like Service principals or Any principals, are accepted by CloudWatch.

‎packages/@aws-cdk/aws-logs/lib/log-group.ts

+18
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,11 @@ export interface ILogGroup extends iam.IResourceWithPolicy {
6969
*/
7070
grantWrite(grantee: iam.IGrantable): iam.Grant;
7171

72+
/**
73+
* Give permissions to read from this log group and streams
74+
*/
75+
grantRead(grantee: iam.IGrantable): iam.Grant;
76+
7277
/**
7378
* Give the indicated permissions on this log group and all streams
7479
*/
@@ -169,6 +174,19 @@ abstract class LogGroupBase extends Resource implements ILogGroup {
169174
return this.grant(grantee, 'logs:CreateLogStream', 'logs:PutLogEvents');
170175
}
171176

177+
/**
178+
* Give permissions to read and filter events from this log group
179+
*/
180+
public grantRead(grantee: iam.IGrantable) {
181+
return this.grant(grantee,
182+
'logs:FilterLogEvents',
183+
'logs:GetLogEvents',
184+
'logs:GetLogGroupFields',
185+
'logs:DescribeLogGroups',
186+
'logs:DescribeLogStreams',
187+
);
188+
}
189+
172190
/**
173191
* Give the indicated permissions on this log group and all streams
174192
*/

‎packages/@aws-cdk/aws-logs/test/integ.loggroup-grantread.js.snapshot/aws-cdk-loggroup-grantreads-integ.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "22.0.0",
3+
"files": {
4+
"f5ee43894e543af0834d9c1eaa47e8ac9913473f9a8fd8203c3743cad0db8b34": {
5+
"source": {
6+
"path": "aws-cdk-loggroup-grantreads-integ.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "f5ee43894e543af0834d9c1eaa47e8ac9913473f9a8fd8203c3743cad0db8b34.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-logs/test/integ.loggroup-grantread.js.snapshot/aws-cdk-loggroup-grantreads-integ.template.json

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"Resources": {
3+
"LogGroupF5B46931": {
4+
"Type": "AWS::Logs::LogGroup",
5+
"Properties": {
6+
"RetentionInDays": 731
7+
},
8+
"UpdateReplacePolicy": "Retain",
9+
"DeletionPolicy": "Retain"
10+
},
11+
"LogGroupPolicyResourcePolicy6FA18555": {
12+
"Type": "AWS::Logs::ResourcePolicy",
13+
"Properties": {
14+
"PolicyDocument": {
15+
"Fn::Join": [
16+
"",
17+
[
18+
"{\"Statement\":[{\"Action\":[\"logs:FilterLogEvents\",\"logs:GetLogEvents\",\"logs:GetLogGroupFields\",\"logs:DescribeLogGroups\",\"logs:DescribeLogStreams\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"es.amazonaws.com\"},\"Resource\":\"",
19+
{
20+
"Fn::GetAtt": [
21+
"LogGroupF5B46931",
22+
"Arn"
23+
]
24+
},
25+
"\"}],\"Version\":\"2012-10-17\"}"
26+
]
27+
]
28+
},
29+
"PolicyName": "awscdkloggroupgrantreadsintegLogGroupPolicy974F6709"
30+
}
31+
}
32+
},
33+
"Parameters": {
34+
"BootstrapVersion": {
35+
"Type": "AWS::SSM::Parameter::Value<String>",
36+
"Default": "/cdk-bootstrap/hnb659fds/version",
37+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
38+
}
39+
},
40+
"Rules": {
41+
"CheckBootstrapVersion": {
42+
"Assertions": [
43+
{
44+
"Assert": {
45+
"Fn::Not": [
46+
{
47+
"Fn::Contains": [
48+
[
49+
"1",
50+
"2",
51+
"3",
52+
"4",
53+
"5"
54+
],
55+
{
56+
"Ref": "BootstrapVersion"
57+
}
58+
]
59+
}
60+
]
61+
},
62+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
63+
}
64+
]
65+
}
66+
}
67+
}

‎packages/@aws-cdk/aws-logs/test/integ.loggroup-grantread.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"22.0.0"}

‎packages/@aws-cdk/aws-logs/test/integ.loggroup-grantread.js.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "22.0.0",
3+
"testCases": {
4+
"loggroup-grantreads/DefaultTest": {
5+
"stacks": [
6+
"aws-cdk-loggroup-grantreads-integ"
7+
],
8+
"assertionStack": "loggroup-grantreads/DefaultTest/DeployAssert",
9+
"assertionStackName": "loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA"
10+
}
11+
}
12+
}

‎packages/@aws-cdk/aws-logs/test/integ.loggroup-grantread.js.snapshot/loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "22.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-logs/test/integ.loggroup-grantread.js.snapshot/loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk/aws-logs/test/integ.loggroup-grantread.js.snapshot/manifest.json

+117
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
{
2+
"version": "22.0.0",
3+
"artifacts": {
4+
"aws-cdk-loggroup-grantreads-integ.assets": {
5+
"type": "cdk:asset-manifest",
6+
"properties": {
7+
"file": "aws-cdk-loggroup-grantreads-integ.assets.json",
8+
"requiresBootstrapStackVersion": 6,
9+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
10+
}
11+
},
12+
"aws-cdk-loggroup-grantreads-integ": {
13+
"type": "aws:cloudformation:stack",
14+
"environment": "aws://unknown-account/unknown-region",
15+
"properties": {
16+
"templateFile": "aws-cdk-loggroup-grantreads-integ.template.json",
17+
"validateOnSynth": false,
18+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
19+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/f5ee43894e543af0834d9c1eaa47e8ac9913473f9a8fd8203c3743cad0db8b34.json",
21+
"requiresBootstrapStackVersion": 6,
22+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
23+
"additionalDependencies": [
24+
"aws-cdk-loggroup-grantreads-integ.assets"
25+
],
26+
"lookupRole": {
27+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
28+
"requiresBootstrapStackVersion": 8,
29+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
30+
}
31+
},
32+
"dependencies": [
33+
"aws-cdk-loggroup-grantreads-integ.assets"
34+
],
35+
"metadata": {
36+
"/aws-cdk-loggroup-grantreads-integ/LogGroup/Resource": [
37+
{
38+
"type": "aws:cdk:logicalId",
39+
"data": "LogGroupF5B46931"
40+
}
41+
],
42+
"/aws-cdk-loggroup-grantreads-integ/LogGroup/Policy/ResourcePolicy": [
43+
{
44+
"type": "aws:cdk:logicalId",
45+
"data": "LogGroupPolicyResourcePolicy6FA18555"
46+
}
47+
],
48+
"/aws-cdk-loggroup-grantreads-integ/BootstrapVersion": [
49+
{
50+
"type": "aws:cdk:logicalId",
51+
"data": "BootstrapVersion"
52+
}
53+
],
54+
"/aws-cdk-loggroup-grantreads-integ/CheckBootstrapVersion": [
55+
{
56+
"type": "aws:cdk:logicalId",
57+
"data": "CheckBootstrapVersion"
58+
}
59+
]
60+
},
61+
"displayName": "aws-cdk-loggroup-grantreads-integ"
62+
},
63+
"loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA.assets": {
64+
"type": "cdk:asset-manifest",
65+
"properties": {
66+
"file": "loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA.assets.json",
67+
"requiresBootstrapStackVersion": 6,
68+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
69+
}
70+
},
71+
"loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA": {
72+
"type": "aws:cloudformation:stack",
73+
"environment": "aws://unknown-account/unknown-region",
74+
"properties": {
75+
"templateFile": "loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA.template.json",
76+
"validateOnSynth": false,
77+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
78+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
79+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
80+
"requiresBootstrapStackVersion": 6,
81+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
82+
"additionalDependencies": [
83+
"loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA.assets"
84+
],
85+
"lookupRole": {
86+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
87+
"requiresBootstrapStackVersion": 8,
88+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
89+
}
90+
},
91+
"dependencies": [
92+
"loggroupgrantreadsDefaultTestDeployAssert7C1C7FAA.assets"
93+
],
94+
"metadata": {
95+
"/loggroup-grantreads/DefaultTest/DeployAssert/BootstrapVersion": [
96+
{
97+
"type": "aws:cdk:logicalId",
98+
"data": "BootstrapVersion"
99+
}
100+
],
101+
"/loggroup-grantreads/DefaultTest/DeployAssert/CheckBootstrapVersion": [
102+
{
103+
"type": "aws:cdk:logicalId",
104+
"data": "CheckBootstrapVersion"
105+
}
106+
]
107+
},
108+
"displayName": "loggroup-grantreads/DefaultTest/DeployAssert"
109+
},
110+
"Tree": {
111+
"type": "cdk:tree",
112+
"properties": {
113+
"file": "tree.json"
114+
}
115+
}
116+
}
117+
}

0 commit comments

Comments
 (0)