aws / aws/aws-cdk

(aws_codebuild): I want a disable `createLoggingPermission` options

Open
#22,465 0 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-codebuild effort/large feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Hi I'm Yuji Hatakeyama.
(Sorry I'm not good at English writing)

I think currently CodeBuild Project assign ServiceRole to policy for logging definitely.

I want an option to disable execute `addToRolePolicy` , `createLoggingPermission` logic.
https://github.com/aws/aws-cdk/blob/af1fb7ce4468b14aecbf24e2cc1c6efeb29761b7/packages/%40aws-cdk/aws-codebuild/lib/project.ts#L1115

### Use Case

I'm already prepared Service Role for CodeBuild that having `logs:CreateLogGroup` , `logs:CreateLogStream` and `logs:PutLogEvents` .
Historically reason, our project managed IAM setting by other tool ( not CDK) .

So I need the way not changing IAM setting .

I'm using aws-cdk by Python (`aws-cdk-lib: 2.27.0`)

### Proposed Solution

- Add property `grantLoggingPermission` at [`CommonProjectProps`](https://github.com/aws/aws-cdk/blob/af1fb7ce4468b14aecbf24e2cc1c6efeb29761b7/packages/%40aws-cdk/aws-codebuild/lib/project.ts#L519)
(default is False)

- Add If block
property is true => run following logic
https://github.com/aws/aws-cdk/blob/af1fb7ce4468b14aecbf24e2cc1c6efeb29761b7/packages/%40aws-cdk/aws-codebuild/lib/project.ts#L1115

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

"aws-cdk-lib" = "==2.27.0"

### Environment details (OS name and version, etc.)

Python 3.7.8, Debian 10.5 (Docker)

Contributor guide

Open the contributing guide

Research direction

Read packages/@aws-cdk/aws-codebuild/lib/project.ts at CommonProjectProps and the createLoggingPermission logic around line 1115. Trace how the proposed option reaches that logic; done means users can prevent the logging IAM changes when using an already configured service role, while the existing behavior remains available.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, devops
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.