(aws-cdk-lib): Update ELB access logs to use service principal instead of legacy hardcoded account IDs
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
Update CDK to use ELB service principal logdelivery.elasticloadbalancing.amazonaws.com instead of legacy mode using hardcoded account IDs for access log bucket policies, aligning with updated AWS standards.
### Use Case
CDK currently generates bucket policies using the legacy hardcoded account IDs while AWS documentation shows the service principal method. This creates confusion for customers who follow AWS docs but see different approaches in CDK-generated resources, making it unclear which method is preferred.
### Proposed Solution
Remove the ELBV2_ACCOUNTS mapping in packages/aws-cdk-lib/region-info/build-tools/fact-tables.ts and fallback to the service principal logdelivery.elasticloadbalancing.amazonaws.com for all regions. This would:
1. Delete the hardcoded account ID mapping
2. Update the logic to use the service principal as default
### Other Information
AWS Documentation References:
- [ALB Access Logs](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-logging-bucket-permissions)
- [CLB Access Logs](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html#attach-bucket-policy)
No breaking changes - both methods remain functional, but CDK would align with current AWS documentation standards and reduce confusing and maintenance overhead.
### Acknowledgements
- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### AWS CDK Library version (aws-cdk-lib)
N/A this is currently in any version of CDK
### AWS CDK CLI version
N/A this is currently in any version of CDK
### Environment details (OS name and version, etc.)
N/A this is currently in any version of CDK
Contributor guide
Research direction
Start in packages/aws-cdk-lib/region-info/build-tools/fact-tables.ts by reading the ELBV2_ACCOUNTS mapping and the logic that consumes it for ELB access-log bucket policies. Use the linked AWS ALB and CLB access-logging documentation as the behavior reference. Done means the hardcoded mapping is removed and generated policies use logdelivery.elasticloadbalancing.amazonaws.com for all regions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100