Depend on bucket and policy before configuring ELB logging

[schof]

I tried adding logging support to my VPC using the following:

    const alb = new Alb.ApplicationLoadBalancer(this, 'LB', {
      vpc,
      internetFacing: true
    })

    const bucket = new Bucket(this, 'Bucket', {
      encryption: BucketEncryption.KmsManaged
    })
    alb.logAccessLogs(bucket)

When running cdk deploy I got an expected warning about IAM changes and the permission looks to be correct.

+ │ ${Bucket.Arn}/* │ Allow │ s3:PutObject │ AWS:arn:${AWS::Partition}:iam::127311923021:root

It appears that there is a bug in the CF template which is not waiting on the bucket policy to finish completion before it attempts to add the logging in the VPC.

Access Denied for bucket: [BUCKET NAME]. Please check S3bucket permission (Service: AmazonElasticLoadBalancingV2; Status Code: 400; Error Code: InvalidConfigurationRequest; Request ID: 657ff61c-23dd-11e9-94e9-c57251c19c33)

I confirmed this was the case by checking the CF events in the console.

[schof]

I found a temporary workaround but it's not perfect since I couldn't figure out a way to add DependsOn for the BucketPolicy that is also being created.

// Temporary Hack (https://github.com/awslabs/aws-cdk/issues/1633)
const albResource = alb.node.findChild('Resource') as Alb.CfnLoadBalancer
const bucketResource = bucket.node.findChild('Resource') as cdk.Resource
albResource.addDependency(bucketResource)

It only works because the ALB takes so long to create (from scratch) that the bucket stuff is generally done in time. I tried working up a fix but I ran into some difficulties with test-region and my general unfamiliarity with the source.

[RomainMuller]

This will be much easier to fix (and much cleaner, too) once #1583 has landed. At this point we'll be able to simply register the dependency properly in the logAccesLogs method.

[gbooth27]

I just ran into this, any ETA on a fix?

[pepito-j]

Hey team. Wanted to chime in as I think I found an issue with how the dependency is being placed. If the ApplicationLoadBalancer Construct gets extended and the user configures bucket access logs, this is going to create a circular dependency because of this line:

• 99e085d#diff-4ac6defb2cef80da78827078f8db037dd82bdff07c7db2bc2206be765478a134R94-R95
• https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts#L285-L286

The dependency should be written as this.node.defaultChild!.node.addDependency(bucket) instead since I think we're only concerned with the CfnLoadBalancer depending on the L2 Bucket. Otherwise, we can maybe have the CfnLoadBalancer directly depend on the CfnBucketPolicy since the reference is already implied between the CfnLoadBalancer and the CfnBucket.

The parent ALB, if extended, will end up depending on it's own children which will then trigger the children to depend on one another. For example:

export class CustomLB extends ApplicationLoadBalancer {

  constructor(scope: Construct, id: string, vpc: cdk.aws_ec2.IVpc) {
    super(scope, id, { vpc });

    const accessLogsBucket = new Bucket(this, `ALBAccessLogsBucket`, {      
      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
      encryption: BucketEncryption.S3_MANAGED,
      versioned: true,
      serverAccessLogsPrefix: 'selflog/',
      enforceSSL: true,
    });

    this.logAccessLogs(accessLogsBucket);
  }
}

Returns the following dependencies:

 "Resources": {
  "ALBAEE750D2": {
   "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
   "Properties": {...},
   "DependsOn": [
    "ALBALBAccessLogsBucketPolicy05AC83C7",
    "ALBALBAccessLogsBucket01758B82"
   ],
   "Metadata": {
    "aws:cdk:path": "Stack/ALB/Resource"
   }
  },
  "ALBALBAccessLogsBucket01758B82": {
   "Type": "AWS::S3::Bucket",
   "Properties": {...},
   "DependsOn": [
    "ALBALBAccessLogsBucketPolicy05AC83C7" // <----- Circular Dependency. BucketPolicy already references Bucket
   ],
   "UpdateReplacePolicy": "Retain",
   "DeletionPolicy": "Retain",
   "Metadata": {
    "aws:cdk:path": "Stack/ALB/ALBAccessLogsBucket/Resource"
   }
  },
  "ALBALBAccessLogsBucketPolicy05AC83C7": {
   "Type": "AWS::S3::BucketPolicy",
   "Properties": {
    "Bucket": {
     "Ref": "ALBALBAccessLogsBucket01758B82"
    },
    "PolicyDocument": {...}
   },
   "DependsOn": [
    "ALBALBAccessLogsBucket01758B82"
   ],
   "Metadata": {
    "aws:cdk:path": "Stack/ALB/ALBAccessLogsBucket/Policy/Resource"
   }
  },