(aws-s3): Invalid configuration for server access logging bucket when using ObjectOwnership.BUCKET_OWNER_ENFORCED

[shanman190]

Describe the bug

let accessLogsBucket = new Bucket(scope, 'AccessLogsBucket', {
  objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED, // <-- start of the issue here
});

let dataBucket = new Bucket(scope, 'DataBucket', {
  objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
  serverAccessLogsBucket: accessLogsBucket // <-- second part of the issue
});

This internally yields an S3 Bucket representing the AccessLogsBucket in the following YAML:

AccessLogsBucket:
    Type: AWS::S3::Bucket
    Properties:
        AccessControl: LogDeliveryWrite # <-- third part of the problem
        OwnershipControls:
            Rules:
            - ObjectOwnership: BucketOwnerEnforced
        UpdateReplacePolicy: Retain
        DeletionPolicy: Retain

In this CloudFormation template, the S3 service rejects the request stating that ACLs cannot be configured when ObjectOwnership is configured to BucketOwnerEnfoced.

Source:

aws-cdk/packages/@aws-cdk/aws-s3/lib/bucket.ts

Line 1832 in 9726e8f

props.serverAccessLogsBucket.allowLogDelivery();

Expected Behavior

If ObjectOwnership.BUCKET_OWNER_ENFORCED has been configured, then the ACL should not be set

Current Behavior

The S3 service returns the following error to CloudFormation:

Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting (Service: Amazon S3; Status Code: 400; Error Code: InvalidBucketAclWithObjectOwnership; [...])

Reproduction Steps

See bug description

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.42.1

Framework Version

No response

Node.js Version

16.17.0

OS

Windows

Language

Typescript, Python

Language Version

No response

Other information

No response

[shanman190]

What would be even more ideal, is adding the S3 server access logging resource policy automatically when this configuration is encountered.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3ServerAccessLogsPolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.amazonaws.com"
            },
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/EXAMPLE-LOGGING-PREFIX*",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:s3:::SOURCE-BUCKET-NAME"
                },
                "StringEquals": {
                    "aws:SourceAccount": "SOURCE-ACCOUNT-ID"
                }
            }
        }
    ]
}

Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html

[peterwoodworth]

You're right, we should support this use case. We should be able to detect the type of object ownership and do something different here if it's BUCKET_OWNER_ENFORCED:

aws-cdk/packages/@aws-cdk/aws-s3/lib/bucket.ts

Line 2186 in 9726e8f

private allowLogDelivery() {

In the meantime you can remove the prop with escape hatches, here's an example which should work

const bucket = new Bucket(...)
(bucket.node.defaultChild as CfnBucket).addPropertyDeletionOverride('AccessControl');

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.