elasticloadbalancing: allow logAccessLogs on environment agnostic stack
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the feature
Currently `BaseLoadBalancer.logAccessLogs` requires that the Stack has a specific region specified on the Environment.
This seems a pretty arbitrary limitation - why should this be necessary? Looking at the code, it seems to be in order to set a principal, but other logging constructs like flowLog allow specifying roles, and indeed [if the region doesn't resolve to an account in `BaseLoadBalancer.resourcePolicyPrincipal` it just returns `iam.ServicePrincipal('logdelivery.elasticloadbalancing.amazonaws.com')`](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts#L315), so why shouldn't it do that if the region is unresolved too, as it's only using the region to find an account?
### Use Case
I want to enable access logging on an ALB created in an environment agnostic stack, which seems a reasonable thing to do.
### Proposed Solution
Change https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts#L306-L309
as so:
```
const region = Stack.of(this).region;
if (Token.isUnresolved(region)) {
return new iam.ServicePrincipal('logdelivery.elasticloadbalancing.amazonaws.com');
}
```
### Other Information
Context - we can't set a region. In our case we have a CDK setup that has been running fine for over a year. A PEN test has flagged that we should have access logs for our ALBs. We have a Product Stack as part of our Stack, and setting a region on the Environment for the Stack completely breaks it; if I set just a region I get this:
```
Error: Stack "my-stack/my-product" cannot reference {my-stack/my-stack-vpc/publicSubnet1/Subnet[Ref]} in stack "my-stack". Cross stack references are only supported for stacks deployed to the same environment or between nested stacks and their parent stack. Set crossRegionReferences=true to enable cross region references
```
(I am setting `crossRegionReferences(true)`)
If I set a region and an account I get this:
```
Resolution error: Cannot generate a physical name for my-stack/my-product/my-stack-my-product-ecs-service-task-def/ExecutionRole, because the region is un-resolved or missing.
```
There seems no way to specify an environment on a product stack.
So currently I'm completely stymied. I guess I'll just have to set up the access logging manually as a handcrafted little snowflake.
### Acknowledgements
- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.99.1
### Environment details (OS name and version, etc.)
macOs & linux
Contributor guide
Research direction
Start in packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts, around the resourcePolicyPrincipal logic at lines 306-315, and read how logAccessLogs uses it. The change is complete when access logging can be enabled for an environment-agnostic stack by using the unresolved-region fallback described in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100