aws / aws/aws-cdk

aws-s3: Unable to Disable ACLs for Access Log Bucket

Open
#26,832 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-s3 bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

General S3 best practices now [recommend](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html) that bucket ACLs be disabled, leading bucket ownership controls to be configured as `BUCKET_OWNER_ENFORCED`.

While I can successfully attach a bucket policy to an access log bucket that grants `logging.s3.amazonaws.com` with `s3:PutObject` permissions per [this](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ownership-migrating-acls-prerequisites.html#object-ownership-server-access-logs) documentation, I am unable to set that access log bucket's ownership to `BUCKET_OWNER_ENFORCED`. S3 throws an exception during bucket creation and modification because [CDK automatically sets](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-s3/lib/bucket.ts#L1885) the bucket's `AccessControl` to `LogDeliveryWrite` when it is provided to another bucket's `serverAccessLogsBucket` property.

### Expected Behavior

Bucket creation and modification succeeds for an access log bucket with ownership controls set to `BUCKET_OWNER_ENFORCED`.

### Current Behavior

Bucket creation and modification fails with
```
Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting (Service: Amazon S3; Status Code: 400; Error Code: InvalidBucketAclWithObjectOwnership; Request ID: ; S3 Extended Request ID: ; Proxy: null)
```
for an access log bucket with ownership controls set to `BUCKET_OWNER_ENFORCED`.

### Reproduction Steps

```
const accessLogBucket = new Bucket(scope, "TestAccessLogBucket", {
bucketName: "TestAccessLogBucket",
encryption: BucketEncryption.S3_MANAGED,
enforceSSL: true,
objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
versioned: true
});

const bucket = new Bucket(scope, "TestBucket", {
bucketName: "TestBucket",
encryption: BucketEncryption.S3_MANAGED,
enforceSSL: true,
objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
serverAccessLogsBucket: accessLogBucket,
versioned: true
});
```

### Possible Solution

A potential backward compatible change would check whether a bucket's `BUCKET_OWNER_ENFORCED` property disables ACLs for a bucket prior to automatically setting `AccessControl` to `LogDeliveryWrite` when that bucket is provided to `serverAccessLogsBucket`. If ACLs are disabled, `AccessControl` would be ignored and the customer would need to add a bucket policy providing `logging.s3.amazonaws.com` with `s3:PutObject` permissions.

Alternatively, we may be able to expose a bucket's logging configuration to allow for manually setting the access log bucket.

### Additional Information/Context

_No response_

### CDK CLI Version

2.91.0

### Framework Version

_No response_

### Node.js Version

v14.21.3

### OS

Linux

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-s3/lib/bucket.ts around the automatic AccessControl assignment referenced in the issue, then reproduce the failure with the two-bucket TypeScript example using BUCKET_OWNER_ENFORCED and serverAccessLogsBucket. Determine how ACL-disabled ownership should interact with LogDeliveryWrite; done means access-log bucket creation and modification succeed without the InvalidBucketAclWithObjectOwnership error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.