Skip to content

Commit 52a5579

Browse files
sakurai-ryosakurai-ryo
authored
feat(ecs): log retention for FireLensLogDriver (#28354)
This PR resolves the missing `logs:PutRetentionPolicy` permission issue when using `FireLensLogDriver` with CloudWatch Logs. ### Description When using `FireLensLogDriver` to send logs to CloudWatch Logs, we can specify the retention period for newly created Log Groups by specifying `log_retention_days` in the `FireLensLogDriverProps.options`. https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecs.FireLensLogDriverProps.html#options If you have not added a FluentBit container, CDK will automatically add it to the task definition, and the IAM permissions required for this are added to the task role. https://github.com/aws/aws-cdk/blob/db22b85c9b2a853aa2f830c182a340f0bcf95d1a/packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts#L816 https://github.com/aws/aws-cdk/blob/db22b85c9b2a853aa2f830c182a340f0bcf95d1a/packages/aws-cdk-lib/aws-ecs/lib/firelens-log-router.ts#L170 While `FireLensLogDriver` allows specifying `log_retention_days` for Log Groups, FluentBit cannot set the retention period due to the absence of the `logs:PutRetentionPolicy` policy. Consequently, it results in an `AccessDeniedException`. To address this, the PR adds the necessary `logs:PutRetentionPolicy` permission to the task role when `log_retention_days` is set in `FireLensLogDriverProps.options`, ensuring FluentBit has the required permissions to set the retention period for Log Groups. Relates to #28258 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent f85f486 commit 52a5579

File tree

10 files changed

+227
-125
lines changed

10 files changed

+227
-125
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.firelens-cloudwatch.js.snapshot/aws-ecs-integ.assets.json

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.firelens-cloudwatch.js.snapshot/aws-ecs-integ.template.json

Lines changed: 57 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,6 @@
1818
"VpcPublicSubnet1Subnet5C2D37C4": {
1919
"Type": "AWS::EC2::Subnet",
2020
"Properties": {
21-
"VpcId": {
22-
"Ref": "Vpc8378EB38"
23-
},
2421
"AvailabilityZone": {
2522
"Fn::Select": [
2623
0,
@@ -44,21 +41,24 @@
4441
"Key": "Name",
4542
"Value": "aws-ecs-integ/Vpc/PublicSubnet1"
4643
}
47-
]
44+
],
45+
"VpcId": {
46+
"Ref": "Vpc8378EB38"
47+
}
4848
}
4949
},
5050
"VpcPublicSubnet1RouteTable6C95E38E": {
5151
"Type": "AWS::EC2::RouteTable",
5252
"Properties": {
53-
"VpcId": {
54-
"Ref": "Vpc8378EB38"
55-
},
5653
"Tags": [
5754
{
5855
"Key": "Name",
5956
"Value": "aws-ecs-integ/Vpc/PublicSubnet1"
6057
}
61-
]
58+
],
59+
"VpcId": {
60+
"Ref": "Vpc8378EB38"
61+
}
6262
}
6363
},
6464
"VpcPublicSubnet1RouteTableAssociation97140677": {
@@ -75,12 +75,12 @@
7575
"VpcPublicSubnet1DefaultRoute3DA9E72A": {
7676
"Type": "AWS::EC2::Route",
7777
"Properties": {
78-
"RouteTableId": {
79-
"Ref": "VpcPublicSubnet1RouteTable6C95E38E"
80-
},
8178
"DestinationCidrBlock": "0.0.0.0/0",
8279
"GatewayId": {
8380
"Ref": "VpcIGWD7BA715C"
81+
},
82+
"RouteTableId": {
83+
"Ref": "VpcPublicSubnet1RouteTable6C95E38E"
8484
}
8585
},
8686
"DependsOn": [
@@ -102,15 +102,15 @@
102102
"VpcPublicSubnet1NATGateway4D7517AA": {
103103
"Type": "AWS::EC2::NatGateway",
104104
"Properties": {
105-
"SubnetId": {
106-
"Ref": "VpcPublicSubnet1Subnet5C2D37C4"
107-
},
108105
"AllocationId": {
109106
"Fn::GetAtt": [
110107
"VpcPublicSubnet1EIPD7E02669",
111108
"AllocationId"
112109
]
113110
},
111+
"SubnetId": {
112+
"Ref": "VpcPublicSubnet1Subnet5C2D37C4"
113+
},
114114
"Tags": [
115115
{
116116
"Key": "Name",
@@ -126,9 +126,6 @@
126126
"VpcPublicSubnet2Subnet691E08A3": {
127127
"Type": "AWS::EC2::Subnet",
128128
"Properties": {
129-
"VpcId": {
130-
"Ref": "Vpc8378EB38"
131-
},
132129
"AvailabilityZone": {
133130
"Fn::Select": [
134131
1,
@@ -152,21 +149,24 @@
152149
"Key": "Name",
153150
"Value": "aws-ecs-integ/Vpc/PublicSubnet2"
154151
}
155-
]
152+
],
153+
"VpcId": {
154+
"Ref": "Vpc8378EB38"
155+
}
156156
}
157157
},
158158
"VpcPublicSubnet2RouteTable94F7E489": {
159159
"Type": "AWS::EC2::RouteTable",
160160
"Properties": {
161-
"VpcId": {
162-
"Ref": "Vpc8378EB38"
163-
},
164161
"Tags": [
165162
{
166163
"Key": "Name",
167164
"Value": "aws-ecs-integ/Vpc/PublicSubnet2"
168165
}
169-
]
166+
],
167+
"VpcId": {
168+
"Ref": "Vpc8378EB38"
169+
}
170170
}
171171
},
172172
"VpcPublicSubnet2RouteTableAssociationDD5762D8": {
@@ -183,12 +183,12 @@
183183
"VpcPublicSubnet2DefaultRoute97F91067": {
184184
"Type": "AWS::EC2::Route",
185185
"Properties": {
186-
"RouteTableId": {
187-
"Ref": "VpcPublicSubnet2RouteTable94F7E489"
188-
},
189186
"DestinationCidrBlock": "0.0.0.0/0",
190187
"GatewayId": {
191188
"Ref": "VpcIGWD7BA715C"
189+
},
190+
"RouteTableId": {
191+
"Ref": "VpcPublicSubnet2RouteTable94F7E489"
192192
}
193193
},
194194
"DependsOn": [
@@ -210,15 +210,15 @@
210210
"VpcPublicSubnet2NATGateway9182C01D": {
211211
"Type": "AWS::EC2::NatGateway",
212212
"Properties": {
213-
"SubnetId": {
214-
"Ref": "VpcPublicSubnet2Subnet691E08A3"
215-
},
216213
"AllocationId": {
217214
"Fn::GetAtt": [
218215
"VpcPublicSubnet2EIP3C605A87",
219216
"AllocationId"
220217
]
221218
},
219+
"SubnetId": {
220+
"Ref": "VpcPublicSubnet2Subnet691E08A3"
221+
},
222222
"Tags": [
223223
{
224224
"Key": "Name",
@@ -234,9 +234,6 @@
234234
"VpcPrivateSubnet1Subnet536B997A": {
235235
"Type": "AWS::EC2::Subnet",
236236
"Properties": {
237-
"VpcId": {
238-
"Ref": "Vpc8378EB38"
239-
},
240237
"AvailabilityZone": {
241238
"Fn::Select": [
242239
0,
@@ -260,21 +257,24 @@
260257
"Key": "Name",
261258
"Value": "aws-ecs-integ/Vpc/PrivateSubnet1"
262259
}
263-
]
260+
],
261+
"VpcId": {
262+
"Ref": "Vpc8378EB38"
263+
}
264264
}
265265
},
266266
"VpcPrivateSubnet1RouteTableB2C5B500": {
267267
"Type": "AWS::EC2::RouteTable",
268268
"Properties": {
269-
"VpcId": {
270-
"Ref": "Vpc8378EB38"
271-
},
272269
"Tags": [
273270
{
274271
"Key": "Name",
275272
"Value": "aws-ecs-integ/Vpc/PrivateSubnet1"
276273
}
277-
]
274+
],
275+
"VpcId": {
276+
"Ref": "Vpc8378EB38"
277+
}
278278
}
279279
},
280280
"VpcPrivateSubnet1RouteTableAssociation70C59FA6": {
@@ -291,21 +291,18 @@
291291
"VpcPrivateSubnet1DefaultRouteBE02A9ED": {
292292
"Type": "AWS::EC2::Route",
293293
"Properties": {
294-
"RouteTableId": {
295-
"Ref": "VpcPrivateSubnet1RouteTableB2C5B500"
296-
},
297294
"DestinationCidrBlock": "0.0.0.0/0",
298295
"NatGatewayId": {
299296
"Ref": "VpcPublicSubnet1NATGateway4D7517AA"
297+
},
298+
"RouteTableId": {
299+
"Ref": "VpcPrivateSubnet1RouteTableB2C5B500"
300300
}
301301
}
302302
},
303303
"VpcPrivateSubnet2Subnet3788AAA1": {
304304
"Type": "AWS::EC2::Subnet",
305305
"Properties": {
306-
"VpcId": {
307-
"Ref": "Vpc8378EB38"
308-
},
309306
"AvailabilityZone": {
310307
"Fn::Select": [
311308
1,
@@ -329,21 +326,24 @@
329326
"Key": "Name",
330327
"Value": "aws-ecs-integ/Vpc/PrivateSubnet2"
331328
}
332-
]
329+
],
330+
"VpcId": {
331+
"Ref": "Vpc8378EB38"
332+
}
333333
}
334334
},
335335
"VpcPrivateSubnet2RouteTableA678073B": {
336336
"Type": "AWS::EC2::RouteTable",
337337
"Properties": {
338-
"VpcId": {
339-
"Ref": "Vpc8378EB38"
340-
},
341338
"Tags": [
342339
{
343340
"Key": "Name",
344341
"Value": "aws-ecs-integ/Vpc/PrivateSubnet2"
345342
}
346-
]
343+
],
344+
"VpcId": {
345+
"Ref": "Vpc8378EB38"
346+
}
347347
}
348348
},
349349
"VpcPrivateSubnet2RouteTableAssociationA89CAD56": {
@@ -360,12 +360,12 @@
360360
"VpcPrivateSubnet2DefaultRoute060D2087": {
361361
"Type": "AWS::EC2::Route",
362362
"Properties": {
363-
"RouteTableId": {
364-
"Ref": "VpcPrivateSubnet2RouteTableA678073B"
365-
},
366363
"DestinationCidrBlock": "0.0.0.0/0",
367364
"NatGatewayId": {
368365
"Ref": "VpcPublicSubnet2NATGateway9182C01D"
366+
},
367+
"RouteTableId": {
368+
"Ref": "VpcPrivateSubnet2RouteTableA678073B"
369369
}
370370
}
371371
},
@@ -383,11 +383,11 @@
383383
"VpcVPCGWBF912B6E": {
384384
"Type": "AWS::EC2::VPCGatewayAttachment",
385385
"Properties": {
386-
"VpcId": {
387-
"Ref": "Vpc8378EB38"
388-
},
389386
"InternetGatewayId": {
390387
"Ref": "VpcIGWD7BA715C"
388+
},
389+
"VpcId": {
390+
"Ref": "Vpc8378EB38"
391391
}
392392
}
393393
},
@@ -421,7 +421,8 @@
421421
"logs:CreateLogGroup",
422422
"logs:CreateLogStream",
423423
"logs:DescribeLogStreams",
424-
"logs:PutLogEvents"
424+
"logs:PutLogEvents",
425+
"logs:PutRetentionPolicy"
425426
],
426427
"Effect": "Allow",
427428
"Resource": "*"
@@ -453,7 +454,8 @@
453454
},
454455
"log_group_name": "ecs-integ-test",
455456
"auto_create_group": "true",
456-
"log_stream_prefix": "nginx"
457+
"log_stream_prefix": "nginx",
458+
"log_retention_days": "1"
457459
}
458460
},
459461
"Name": "nginx",

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.firelens-cloudwatch.js.snapshot/cdk.out

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.firelens-cloudwatch.js.snapshot/integ.json

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/fargate/integ.firelens-cloudwatch.js.snapshot/manifest.json

Lines changed: 7 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)