aws / aws/aws-cdk

elasticloadbalancing: allow logAccessLogs on environment agnostic stack

Open
#27,432 4 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-elasticloadbalancing effort/small feature-request good first issue p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the feature

Currently `BaseLoadBalancer.logAccessLogs` requires that the Stack has a specific region specified on the Environment.

This seems a pretty arbitrary limitation - why should this be necessary? Looking at the code, it seems to be in order to set a principal, but other logging constructs like flowLog allow specifying roles, and indeed [if the region doesn't resolve to an account in `BaseLoadBalancer.resourcePolicyPrincipal` it just returns `iam.ServicePrincipal('logdelivery.elasticloadbalancing.amazonaws.com')`](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts#L315), so why shouldn't it do that if the region is unresolved too, as it's only using the region to find an account?

### Use Case

I want to enable access logging on an ALB created in an environment agnostic stack, which seems a reasonable thing to do.

### Proposed Solution

Change https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts#L306-L309
as so:
```
const region = Stack.of(this).region;
if (Token.isUnresolved(region)) {
return new iam.ServicePrincipal('logdelivery.elasticloadbalancing.amazonaws.com');
}
```

### Other Information

Context - we can't set a region. In our case we have a CDK setup that has been running fine for over a year. A PEN test has flagged that we should have access logs for our ALBs. We have a Product Stack as part of our Stack, and setting a region on the Environment for the Stack completely breaks it; if I set just a region I get this:
```
Error: Stack "my-stack/my-product" cannot reference {my-stack/my-stack-vpc/publicSubnet1/Subnet[Ref]} in stack "my-stack". Cross stack references are only supported for stacks deployed to the same environment or between nested stacks and their parent stack. Set crossRegionReferences=true to enable cross region references
```
(I am setting `crossRegionReferences(true)`)

If I set a region and an account I get this:
```
Resolution error: Cannot generate a physical name for my-stack/my-product/my-stack-my-product-ecs-service-task-def/ExecutionRole, because the region is un-resolved or missing.
```

There seems no way to specify an environment on a product stack.

So currently I'm completely stymied. I guess I'll just have to set up the access logging manually as a handcrafted little snowflake.

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.99.1

### Environment details (OS name and version, etc.)

macOs & linux

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts, around the resourcePolicyPrincipal logic at lines 306-315, and read how logAccessLogs uses it. The change is complete when access logging can be enabled for an environment-agnostic stack by using the unresolved-region fallback described in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.