(opensearch): opensearch creates customer resource even though resource policies are now supported
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
CloudWatch log groups support setting resource policies since 2019, so its really time to remove the custom resources that set resource policies here: https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts#L1502
### Expected Behavior
no custom resource, direct setting of resource policy with
```
log.addToResourcePolicy(
new PolicyStatement({
actions: ['logs:PutLogEvents', 'logs:CreateLogStream'],
resources: [log.logGroupArn],
principals: [new ServicePrincipal('es.amazonaws.com')],
})
```
### Current Behavior
Creates customer resource
### Reproduction Steps
create any slow logs
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.70.0
### Framework Version
_No response_
### Node.js Version
18
### OS
AL2
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start in packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts around line 1502 and inspect how slow-log resource policies are currently created. Reproduce a domain with slow logs, then verify that the custom resource is removed and the policy is set directly on the log group as described.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 42/100