Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(elasticloadbalancingv2): dependency between ALB and logging bucket #2221

Merged
merged 2 commits into from
Apr 11, 2019
Merged

fix(elasticloadbalancingv2): dependency between ALB and logging bucket #2221

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c6ddd3c
fix(elasticloadbalancingv2): dependency between ALB and logging bucket
Apr 10, 2019
4e5f471
CR fixes
Apr 10, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,11 +88,10 @@ export class ApplicationLoadBalancer extends BaseLoadBalancer implements IApplic
throw new Error(`Cannot enable access logging; don't know ELBv2 account for region ${region}`);
}

// FIXME: can't use grantPut() here because that only takes IAM objects, not arbitrary principals
bucket.addToResourcePolicy(new iam.PolicyStatement()
.addPrincipal(new iam.AccountPrincipal(account))
.addAction('s3:PutObject')
.addResource(bucket.arnForObjects(prefix || '', '*')));
bucket.grantPut(new iam.AccountPrincipal(account));
eladb marked this conversation as resolved.
Show resolved Hide resolved

// make sure the bucket is created before the ALB
eladb marked this conversation as resolved.
Show resolved Hide resolved
this.node.addDependency(bucket);
}

/**
Expand Down
13 changes: 11 additions & 2 deletions packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/test.load-balancer.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import { expect, haveResource, ResourcePart } from '@aws-cdk/assert';
import { expect, haveResource, ResourcePart, haveResourceLike } from '@aws-cdk/assert';
import ec2 = require('@aws-cdk/aws-ec2');
import s3 = require('@aws-cdk/aws-s3');
import cdk = require('@aws-cdk/cdk');
Expand Down Expand Up @@ -122,6 +122,8 @@ export = {
lb.logAccessLogs(bucket);

// THEN

// verify that the LB attributes reference the bucket
expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::LoadBalancer', {
LoadBalancerAttributes: [
{
Expand All @@ -134,12 +136,14 @@ export = {
}
],
}));

// verify the bucket policy allows the ALB to put objects in the bucket
expect(stack).to(haveResource('AWS::S3::BucketPolicy', {
PolicyDocument: {
Version: '2012-10-17',
Statement: [
{
Action: "s3:PutObject",
Action: [ "s3:PutObject*", "s3:Abort*" ],
Effect: 'Allow',
Principal: { AWS: { "Fn::Join": [ "", [ "arn:", { Ref: "AWS::Partition" }, ":iam::127311923021:root" ] ] } },
Resource: { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "AccessLoggingBucketA6D88F29", "Arn" ] }, "/*" ] ] }
Expand All @@ -148,6 +152,11 @@ export = {
}
}));

// verify the ALB depends on the bucket *and* the bucket policy
expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::LoadBalancer', {
DependsOn: [ 'AccessLoggingBucketPolicy700D7CC6', 'AccessLoggingBucketA6D88F29' ]
}, ResourcePart.CompleteDefinition));

test.done();
},

Expand Down