aws-s3: Unable to Disable ACLs for Access Log Bucket
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
General S3 best practices now [recommend](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html) that bucket ACLs be disabled, leading bucket ownership controls to be configured as `BUCKET_OWNER_ENFORCED`.
While I can successfully attach a bucket policy to an access log bucket that grants `logging.s3.amazonaws.com` with `s3:PutObject` permissions per [this](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ownership-migrating-acls-prerequisites.html#object-ownership-server-access-logs) documentation, I am unable to set that access log bucket's ownership to `BUCKET_OWNER_ENFORCED`. S3 throws an exception during bucket creation and modification because [CDK automatically sets](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-s3/lib/bucket.ts#L1885) the bucket's `AccessControl` to `LogDeliveryWrite` when it is provided to another bucket's `serverAccessLogsBucket` property.
### Expected Behavior
Bucket creation and modification succeeds for an access log bucket with ownership controls set to `BUCKET_OWNER_ENFORCED`.
### Current Behavior
Bucket creation and modification fails with
```
Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting (Service: Amazon S3; Status Code: 400; Error Code: InvalidBucketAclWithObjectOwnership; Request ID: ; S3 Extended Request ID: ; Proxy: null)
```
for an access log bucket with ownership controls set to `BUCKET_OWNER_ENFORCED`.
### Reproduction Steps
```
const accessLogBucket = new Bucket(scope, "TestAccessLogBucket", {
bucketName: "TestAccessLogBucket",
encryption: BucketEncryption.S3_MANAGED,
enforceSSL: true,
objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
versioned: true
});
const bucket = new Bucket(scope, "TestBucket", {
bucketName: "TestBucket",
encryption: BucketEncryption.S3_MANAGED,
enforceSSL: true,
objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
serverAccessLogsBucket: accessLogBucket,
versioned: true
});
```
### Possible Solution
A potential backward compatible change would check whether a bucket's `BUCKET_OWNER_ENFORCED` property disables ACLs for a bucket prior to automatically setting `AccessControl` to `LogDeliveryWrite` when that bucket is provided to `serverAccessLogsBucket`. If ACLs are disabled, `AccessControl` would be ignored and the customer would need to add a bucket policy providing `logging.s3.amazonaws.com` with `s3:PutObject` permissions.
Alternatively, we may be able to expose a bucket's logging configuration to allow for manually setting the access log bucket.
### Additional Information/Context
_No response_
### CDK CLI Version
2.91.0
### Framework Version
_No response_
### Node.js Version
v14.21.3
### OS
Linux
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start in packages/aws-cdk-lib/aws-s3/lib/bucket.ts around the automatic AccessControl assignment referenced in the issue, then reproduce the failure with the two-bucket TypeScript example using BUCKET_OWNER_ENFORCED and serverAccessLogsBucket. Determine how ACL-disabled ownership should interact with LogDeliveryWrite; done means access-log bucket creation and modification succeed without the InvalidBucketAclWithObjectOwnership error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100