aws-elasticloadbalancingv2: logAccessLogs grants too wide permissions

[Lilja-at-funnel]

Describe the bug

We are receiving alerts that our policy has too wide permissions. Anybody using {"Service":"delivery.logs.amazonaws.com"} can potentially use s3:PubObject or s3:GetObjectAcl.

Similar to #29811

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

arn:SourceArn in condition to require the deployed aws account.

Current Behavior

No source arn or similar

Policy produces(values has been changed):

{"Version":"2012-10-17","Statement":[{
"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::12345678910:root"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::loadbalancerlogs-test/AWSLogs/112233445566/*"},
{"Effect":"Allow","Principal":{"Service":"delivery.logs.amazonaws.com"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::loadbalancerlogs-test/AWSLogs/112233445566/*","Condition":{"StringEquals":{"s3:x-amz-acl":"bucket-owner-full-control"}}},
{"Effect":"Allow","Principal":{"Service":"delivery.logs.amazonaws.com"},"Action":"s3:GetBucketAcl","Resource":"arn:aws:s3:::loadbalancerlogs-test"}
]}

Reproduction Steps

    const vpc = new ec2.Vpc(this, 'Vpc', {
        maxAzs: 2,
        subnetConfiguration: [
            {
            cidrMask: 24,
            name: 'ingress',
            subnetType: ec2.SubnetType.PUBLIC,
            },
            {
            cidrMask: 24,
            name: 'egress',
            subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
            },
        ],
    });
    const lb = new elb.ApplicationLoadBalancer(this, 'LoadBalancer', {
      vpc,
      internetFacing: true,
      loadBalancerName: 'repro-api',
      idleTimeout: Duration.seconds(60),
      vpcSubnets: { subnets: clusterResources.subnets },
    })

    const loadBalancerBucket = new s3.Bucket(this, 'LoadBalancerLogs', {
      lifecycleRules: [
        {
          id: 'expire-object',
          enabled: true,
          expiration: Duration.days(30),
        },
      ],
      encryption: s3.BucketEncryption.S3_MANAGED,
      publicReadAccess: false,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
    })

    lb.logAccessLogs(loadBalancerBucket)

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.157.0

Framework Version

No response

Node.js Version

20

OS

Linux

Language

TypeScript

Language Version

No response

Other information

No response

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.