aws / aws/aws-cdk

(aws-cdk-lib): Update ELB access logs to use service principal instead of legacy hardcoded account IDs

Open
#36,676 1 comment 0 reactions 0 assignees View on GitHub
aws-cdk-lib effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Update CDK to use ELB service principal logdelivery.elasticloadbalancing.amazonaws.com instead of legacy mode using hardcoded account IDs for access log bucket policies, aligning with updated AWS standards.

### Use Case

CDK currently generates bucket policies using the legacy hardcoded account IDs while AWS documentation shows the service principal method. This creates confusion for customers who follow AWS docs but see different approaches in CDK-generated resources, making it unclear which method is preferred.

### Proposed Solution

Remove the ELBV2_ACCOUNTS mapping in packages/aws-cdk-lib/region-info/build-tools/fact-tables.ts and fallback to the service principal logdelivery.elasticloadbalancing.amazonaws.com for all regions. This would:

1. Delete the hardcoded account ID mapping
2. Update the logic to use the service principal as default

### Other Information

AWS Documentation References:
- [ALB Access Logs](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-logging-bucket-permissions)
- [CLB Access Logs](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html#attach-bucket-policy)

No breaking changes - both methods remain functional, but CDK would align with current AWS documentation standards and reduce confusing and maintenance overhead.

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

N/A this is currently in any version of CDK

### AWS CDK CLI version

N/A this is currently in any version of CDK

### Environment details (OS name and version, etc.)

N/A this is currently in any version of CDK

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/region-info/build-tools/fact-tables.ts by reading the ELBV2_ACCOUNTS mapping and the logic that consumes it for ELB access-log bucket policies. Use the linked AWS ALB and CLB access-logging documentation as the behavior reference. Done means the hardcoded mapping is removed and generated policies use logdelivery.elasticloadbalancing.amazonaws.com for all regions.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.