aws / aws/aws-cdk

(opensearch): opensearch creates customer resource even though resource policies are now supported

Open
#24,992 3 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-opensearch bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

CloudWatch log groups support setting resource policies since 2019, so its really time to remove the custom resources that set resource policies here: https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts#L1502

### Expected Behavior

no custom resource, direct setting of resource policy with
```
log.addToResourcePolicy(
new PolicyStatement({
actions: ['logs:PutLogEvents', 'logs:CreateLogStream'],
resources: [log.logGroupArn],
principals: [new ServicePrincipal('es.amazonaws.com')],
})
```

### Current Behavior

Creates customer resource

### Reproduction Steps

create any slow logs

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.70.0

### Framework Version

_No response_

### Node.js Version

18

### OS

AL2

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts around line 1502 and inspect how slow-log resource policies are currently created. Reproduce a domain with slow logs, then verify that the custom resource is removed and the policy is set directly on the log group as described.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.