feat(events-targets): add toggle to opt out of resource policy creation for targeted log group #32242

gwaltneyluke · 2024-11-22T00:31:37Z

Issue # (if applicable)

Reason for this change

When a CloudWatch LogGroup is set as the target of an EventBridge rule, a custom resource creates a Log Resource Policy to establish trust so that EventBridge can write messages to CloudWatch. However, there is a strict limit of 10 CloudWatch Log Resource Policies per account per region. This therefore limits the amount of EventBridge rules an account can have writing to CloudWatch.

Description of changes

The optional property createLogGroupResourcePolicy has been added to the LogGroupProps interface. When omitted or set to true, the Resource Policy is created just as the functionality exists today. When set to false, the Resource Policy is not created. The trust between EventBridge and CloudWatch must be established manually.

Description of how you validated changes

Unit tests have been added and are passing. Existing integration tests are passing.

Code was also linked to an existing project, where the new property was toggled on and off. When on, the CloudWatch LogGroup Resource Policy was created, and messages sent to EventBridge were making it to the LogGroup. When off, the CloudWatch LogGroup Resource Policy was NOT created, but a custom Resource Policy still allowed messages sent to the EventBridge to end up in the LogGroup.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

…snapshots

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aws-cdk-automation · 2025-02-02T00:12:41Z

This PR has been in the MERGE CONFLICTS state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

aws-cdk-automation · 2025-02-10T00:12:00Z

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

github-actions · 2025-02-10T00:12:15Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

aaythapa

Thanks for contributing! Changes look good, just a couple nits and a question. I see there are some merge conflicts as well.

aaythapa · 2025-02-10T18:46:10Z

packages/aws-cdk-lib/aws-events-targets/README.md

-to set `installLatestAwsSdk` to `true`. This may be problematic for CN partition deployment. To
-workaround this issue, set `installLatestAwsSdk` to `false`.
+By default, the CloudWatch LogGroup target will create a LogGroup Resource Policy which allows
+EventBridge to write to the target LogGroup. If you want to manage this trust relationship manually,


How is the trust relationship managed manually? Is there a way we can make it easier through a property? If there is then we should go with that and my thinking is if they set that property then we don't make a resource policy. So the property will not only opt users out of making resource policies but make it easier to manage the trust. What are your thoughts on this?

I was thinking the trust relationship would be managed with a pre-existing Log Group Resource Policy that allows EventBridge to write to any log group with a specific prefix (ex: /aws/events/). This way we can have several rules write to different log groups and that trust is managed by a single policy. This might be a little too coarse a policy, though.

Another idea would be to provide an existing Log Group Resource Policy to this method, and the method can add a statement to that policy which allows EventBridge to write to the specified log group, rather than adding a whole new policy.

aaythapa · 2025-02-10T18:46:20Z

packages/aws-cdk-lib/aws-events-targets/README.md

+The CloudWatch LogGroup Resource Policy is created using an AWS custom resource internally which will
+default to set `installLatestAwsSdk` to `true`. This may be problematic for CN partition deployment.
+To workaround this issue, set `installLatestAwsSdk` to `false`.


Nice! Thanks for adding

aaythapa · 2025-02-10T18:46:53Z

packages/aws-cdk-lib/aws-events-targets/lib/log-group.ts

+   * Whether a CloudWatch LogGroup Resource Policy will be
+   * created to allow EventBridge to write to the LogGroup
+   *
+   * @default - create the CloudWatch LogGroup Resource Policy


nit

Suggested change

* @default - create the CloudWatch LogGroup Resource Policy

* @default - true (create the CloudWatch LogGroup Resource Policy)

aaythapa · 2025-02-10T18:48:48Z

packages/aws-cdk-lib/aws-events-targets/lib/log-group.ts

+    const createLogGroupResourcePolicy = this.props.createLogGroupResourcePolicy !== undefined ?
+      this.props.createLogGroupResourcePolicy :
+      true;


nit:

Suggested change

const createLogGroupResourcePolicy = this.props.createLogGroupResourcePolicy !== undefined ?

this.props.createLogGroupResourcePolicy :

true;

const createLogGroupResourcePolicy = this.props.createLogGroupResourcePolicy ?? true;

aws-cdk-automation · 2025-02-12T00:11:19Z

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

aws-cdk-automation · 2025-02-13T00:11:11Z

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

aws-cdk-automation · 2025-02-14T21:15:57Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 6a30077
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Luke Gwaltney added 2 commits November 21, 2024 17:44

feat: add flag to opt out of log group resource policy

599a877

docs: remove trailing space

4d1b0ea

github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 labels Nov 22, 2024

aws-cdk-automation requested a review from a team November 22, 2024 00:31

github-actions bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label Nov 22, 2024

aws-cdk-automation previously requested changes Nov 22, 2024

View reviewed changes

test: add target without log resource policy to integration test and …

2695335

…snapshots

gwaltneyluke added 2 commits November 21, 2024 20:52

Merge branch 'main' into create-logs-resource-policy

41b7c06

test: integration tests fix

3907987

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 22, 2024

gwaltneyluke added 2 commits November 22, 2024 15:06

Merge branch 'main' into create-logs-resource-policy

27c7387

Merge branch 'main' into create-logs-resource-policy

57b1034

github-actions bot mentioned this pull request Dec 1, 2024

Monthly PR metrics report #32340

Open

aws-cdk-automation added the closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. label Feb 10, 2025

aws-cdk-automation closed this Feb 10, 2025

github-actions bot locked as resolved and limited conversation to collaborators Feb 10, 2025

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 10, 2025

aaythapa reopened this Feb 10, 2025

aaythapa reviewed Feb 10, 2025

View reviewed changes

aaythapa self-assigned this Feb 10, 2025

aws-cdk-automation closed this Feb 12, 2025

aaythapa reopened this Feb 12, 2025

aaythapa added the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Feb 12, 2025

aws-cdk-automation closed this Feb 13, 2025

aaythapa reopened this Feb 13, 2025

aws unlocked this conversation Feb 13, 2025

aaythapa added pr-linter/do-not-close The PR linter will not close this PR while this label is present and removed closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. labels Feb 13, 2025

github-actions bot removed the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 7 days. label Feb 13, 2025

gwaltneyluke added 2 commits February 14, 2025 15:27

Merge branch 'main' into create-logs-resource-policy

2d1ae13

refactor: comment boolean default, simplify default behavior

6a30077

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 14, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(events-targets): add toggle to opt out of resource policy creation for targeted log group #32242

feat(events-targets): add toggle to opt out of resource policy creation for targeted log group #32242

gwaltneyluke commented Nov 22, 2024

aws-cdk-automation left a comment

aws-cdk-automation commented Feb 2, 2025

aws-cdk-automation commented Feb 10, 2025

github-actions bot commented Feb 10, 2025

aaythapa left a comment

aaythapa Feb 10, 2025

gwaltneyluke Feb 14, 2025

aaythapa Feb 10, 2025

aaythapa Feb 10, 2025

gwaltneyluke Feb 14, 2025

aaythapa Feb 10, 2025 •

edited

Loading

gwaltneyluke Feb 14, 2025

aws-cdk-automation commented Feb 12, 2025

aws-cdk-automation commented Feb 13, 2025

aws-cdk-automation commented Feb 14, 2025

	* @default - create the CloudWatch LogGroup Resource Policy
	* @default - true (create the CloudWatch LogGroup Resource Policy)

feat(events-targets): add toggle to opt out of resource policy creation for targeted log group #32242

Are you sure you want to change the base?

feat(events-targets): add toggle to opt out of resource policy creation for targeted log group #32242

Conversation

gwaltneyluke commented Nov 22, 2024

Issue # (if applicable)

Reason for this change

Description of changes

Description of how you validated changes

Checklist

aws-cdk-automation left a comment

Choose a reason for hiding this comment

aws-cdk-automation commented Feb 2, 2025

aws-cdk-automation commented Feb 10, 2025

github-actions bot commented Feb 10, 2025

aaythapa left a comment

Choose a reason for hiding this comment

aaythapa Feb 10, 2025

Choose a reason for hiding this comment

gwaltneyluke Feb 14, 2025

Choose a reason for hiding this comment

aaythapa Feb 10, 2025

Choose a reason for hiding this comment

aaythapa Feb 10, 2025

Choose a reason for hiding this comment

gwaltneyluke Feb 14, 2025

Choose a reason for hiding this comment

aaythapa Feb 10, 2025 • edited Loading

Choose a reason for hiding this comment

gwaltneyluke Feb 14, 2025

Choose a reason for hiding this comment

aws-cdk-automation commented Feb 12, 2025

aws-cdk-automation commented Feb 13, 2025

aws-cdk-automation commented Feb 14, 2025

AWS CodeBuild CI Report

aaythapa Feb 10, 2025 •

edited

Loading