Skip to content

Commit 4ff03a8

Browse files
naveenkoppulanaveenkoppula
authored
fix(core): Fix creation of LogGroup for Route53 hosted zone Logging (#356)
* Fix creation of LogGroup for Route53 hosted zone Logging (v117)
1 parent 093fad8 commit 4ff03a8

File tree

3 files changed

+81
-73
lines changed

3 files changed

+81
-73
lines changed

‎src/deployments/cdk/src/apps/phase-0.ts‎

Lines changed: 9 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
import * as cdk from '@aws-cdk/core';
22
import * as accessanalyzer from '@aws-cdk/aws-accessanalyzer';
3-
import * as iam from '@aws-cdk/aws-iam';
4-
import { LogGroup } from '@aws-accelerator/custom-resource-logs-log-group';
5-
import { LogResourcePolicy } from '@aws-accelerator/custom-resource-logs-resource-policy';
63
import { createName } from '@aws-accelerator/cdk-accelerator/src/core/accelerator-name-generator';
74
import * as outputKeys from '@aws-accelerator/common-outputs/src/stack-output';
85
import * as artifactsDeployment from '../deployments/artifacts';
@@ -15,14 +12,20 @@ import * as madDeployment from '../deployments/mad';
1512
import * as secretsDeployment from '../deployments/secrets';
1613
import * as guardDutyDeployment from '../deployments/guardduty';
1714
import { PhaseInput } from './shared';
18-
import { DNS_LOGGING_LOG_GROUP_REGION } from '@aws-accelerator/common/src/util/constants';
19-
import { createR53LogGroupName } from '../common/r53-zones';
2015
import * as accountWarming from '../deployments/account-warming';
2116
import * as passwordPolicy from '../deployments/iam-password-policy';
2217
import * as transitGateway from '../deployments/transit-gateway';
2318
import { getAccountId } from '../utils/accounts';
2419
import * as rsyslogDeployment from '../deployments/rsyslog';
25-
import { IamRoleOutputFinder } from '@aws-accelerator/common-outputs/src/iam-role';
20+
21+
/**********************************************************
22+
* DO NOT DEPEND ON OUTPUTS IN PHASE 0 *
23+
* SINCE WE ARE CREATING CENTRAL BUCKET IN PHASE-0 *
24+
* AND FRESH INSTALL WILL FAIL SINCE WE WILL NOT HAVE ANY *
25+
* OUTPUTS CREATED IN PHASE -1 *
26+
* (EXCEPT) ACCOUNTWARMING SINCE WE DON'T NEED OUTPUTS *
27+
* ACCOUNTWARMING IN FIRST RUN *
28+
**********************************************************/
2629

2730
/**
2831
* This is the main entry point to deploy phase 0.
@@ -175,56 +178,6 @@ export async function deploy({ acceleratorConfig, accountStacks, accounts, conte
175178
logBucket,
176179
});
177180

178-
/**
179-
* Code to create LogGroups required for DNS Logging
180-
*/
181-
const globalOptionsConfig = acceleratorConfig['global-options'];
182-
const zonesConfig = globalOptionsConfig.zones;
183-
const zonesAccountKey = zonesConfig.account;
184-
185-
const zonesStack = accountStacks.getOrCreateAccountStack(zonesAccountKey, DNS_LOGGING_LOG_GROUP_REGION);
186-
const logGroupLambdaRoleOutput = IamRoleOutputFinder.tryFindOneByName({
187-
outputs,
188-
accountKey: zonesAccountKey,
189-
roleKey: 'LogGroupRole',
190-
});
191-
if (logGroupLambdaRoleOutput) {
192-
const logGroups = zonesConfig.names.public.map(phz => {
193-
const logGroupName = createR53LogGroupName({
194-
acceleratorPrefix: context.acceleratorPrefix,
195-
domain: phz,
196-
});
197-
return new LogGroup(zonesStack, `Route53HostedZoneLogGroup`, {
198-
logGroupName,
199-
roleArn: logGroupLambdaRoleOutput.roleArn,
200-
});
201-
});
202-
203-
if (logGroups.length > 0) {
204-
const wildcardLogGroupName = createR53LogGroupName({
205-
acceleratorPrefix: context.acceleratorPrefix,
206-
domain: '*',
207-
});
208-
209-
// Allow r53 services to write to the log group
210-
const logGroupPolicy = new LogResourcePolicy(zonesStack, 'R53LogGroupPolicy', {
211-
policyName: createName({
212-
name: 'query-logging-pol',
213-
}),
214-
policyStatements: [
215-
new iam.PolicyStatement({
216-
actions: ['logs:CreateLogStream', 'logs:PutLogEvents'],
217-
principals: [new iam.ServicePrincipal('route53.amazonaws.com')],
218-
resources: [`arn:aws:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:log-group:${wildcardLogGroupName}`],
219-
}),
220-
],
221-
});
222-
for (const logGroup of logGroups) {
223-
logGroupPolicy.node.addDependency(logGroup);
224-
}
225-
}
226-
}
227-
228181
// TODO Deprecate these outputs
229182
const logArchiveAccountKey = acceleratorConfig['global-options']['central-log-services'].account;
230183
const logArchiveStack = accountStacks.getOrCreateAccountStack(logArchiveAccountKey);

‎src/deployments/cdk/src/apps/phase-1.ts‎

Lines changed: 56 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ import { InterfaceEndpoint } from '../common/interface-endpoints';
1818
import { IamAssets } from '../common/iam-assets';
1919
import { STS } from '@aws-accelerator/common/src/aws/sts';
2020
import { S3 } from '@aws-accelerator/common/src/aws/s3';
21-
import { createRoleName } from '@aws-accelerator/cdk-accelerator/src/core/accelerator-name-generator';
21+
import { createRoleName, createName } from '@aws-accelerator/cdk-accelerator/src/core/accelerator-name-generator';
2222
import { CentralBucketOutput, LogBucketOutput } from '../deployments/defaults/outputs';
2323
import * as budget from '../deployments/billing/budget';
2424
import * as certificates from '../deployments/certificates';
@@ -33,6 +33,11 @@ import { PhaseInput } from './shared';
3333
import { getIamUserPasswordSecretValue } from '../deployments/iam';
3434
import * as cwlCentralLoggingToS3 from '../deployments/central-services/central-logging-s3';
3535
import * as vpcDeployment from '../deployments/vpc';
36+
import { DNS_LOGGING_LOG_GROUP_REGION } from '@aws-accelerator/common/src/util/constants';
37+
import { createR53LogGroupName } from '../common/r53-zones';
38+
import { LogGroup } from '@aws-accelerator/custom-resource-logs-log-group';
39+
import { LogResourcePolicy } from '@aws-accelerator/custom-resource-logs-resource-policy';
40+
import { IamRoleOutputFinder } from '@aws-accelerator/common-outputs/src/iam-role';
3641

3742
export interface IamPolicyArtifactsOutput {
3843
bucketArn: string;
@@ -447,4 +452,54 @@ export async function deploy({ acceleratorConfig, accountStacks, accounts, conte
447452
config: acceleratorConfig,
448453
accounts,
449454
});
455+
456+
/**
457+
* Code to create LogGroups required for DNS Logging
458+
*/
459+
const globalOptionsConfig = acceleratorConfig['global-options'];
460+
const zonesConfig = globalOptionsConfig.zones;
461+
const zonesAccountKey = zonesConfig.account;
462+
463+
const zonesStack = accountStacks.getOrCreateAccountStack(zonesAccountKey, DNS_LOGGING_LOG_GROUP_REGION);
464+
const logGroupLambdaRoleOutput = IamRoleOutputFinder.tryFindOneByName({
465+
outputs,
466+
accountKey: zonesAccountKey,
467+
roleKey: 'LogGroupRole',
468+
});
469+
if (logGroupLambdaRoleOutput) {
470+
const logGroups = zonesConfig.names.public.map(phz => {
471+
const logGroupName = createR53LogGroupName({
472+
acceleratorPrefix: context.acceleratorPrefix,
473+
domain: phz,
474+
});
475+
return new LogGroup(zonesStack, `Route53HostedZoneLogGroup`, {
476+
logGroupName,
477+
roleArn: logGroupLambdaRoleOutput.roleArn,
478+
});
479+
});
480+
481+
if (logGroups.length > 0) {
482+
const wildcardLogGroupName = createR53LogGroupName({
483+
acceleratorPrefix: context.acceleratorPrefix,
484+
domain: '*',
485+
});
486+
487+
// Allow r53 services to write to the log group
488+
const logGroupPolicy = new LogResourcePolicy(zonesStack, 'R53LogGroupPolicy', {
489+
policyName: createName({
490+
name: 'query-logging-pol',
491+
}),
492+
policyStatements: [
493+
new iam.PolicyStatement({
494+
actions: ['logs:CreateLogStream', 'logs:PutLogEvents'],
495+
principals: [new iam.ServicePrincipal('route53.amazonaws.com')],
496+
resources: [`arn:aws:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:log-group:${wildcardLogGroupName}`],
497+
}),
498+
],
499+
});
500+
for (const logGroup of logGroups) {
501+
logGroupPolicy.node.addDependency(logGroup);
502+
}
503+
}
504+
}
450505
}

‎src/deployments/cdk/test/apps/__snapshots__/unsupported-changed.spec.ts.snap‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -534,8 +534,6 @@ exports[`there should not be any unsupported resource changes for AWS::Budgets::
534534

535535
exports[`there should not be any unsupported resource changes for AWS::Budgets::Budget: SharedNetworkPhase0 1`] = `Array []`;
536536

537-
exports[`there should not be any unsupported resource changes for AWS::Budgets::Budget: SharedNetworkPhase0UsEast1 1`] = `Array []`;
538-
539537
exports[`there should not be any unsupported resource changes for AWS::Budgets::Budget: SharedNetworkPhase1 1`] = `
540538
Array [
541539
Object {
@@ -610,6 +608,8 @@ exports[`there should not be any unsupported resource changes for AWS::Budgets::
610608

611609
exports[`there should not be any unsupported resource changes for AWS::Budgets::Budget: SharedNetworkPhase1Endpoint125DF8CB0 1`] = `Array []`;
612610

611+
exports[`there should not be any unsupported resource changes for AWS::Budgets::Budget: SharedNetworkPhase1UsEast1 1`] = `Array []`;
612+
613613
exports[`there should not be any unsupported resource changes for AWS::Budgets::Budget: SharedNetworkPhase1VpcStackCentralB4A762DD 1`] = `Array []`;
614614

615615
exports[`there should not be any unsupported resource changes for AWS::Budgets::Budget: SharedNetworkPhase1VpcStackDev3F77197C 1`] = `Array []`;
@@ -809,8 +809,6 @@ exports[`there should not be any unsupported resource changes for AWS::Directory
809809

810810
exports[`there should not be any unsupported resource changes for AWS::DirectoryService::MicrosoftAD: SharedNetworkPhase0 1`] = `Array []`;
811811

812-
exports[`there should not be any unsupported resource changes for AWS::DirectoryService::MicrosoftAD: SharedNetworkPhase0UsEast1 1`] = `Array []`;
813-
814812
exports[`there should not be any unsupported resource changes for AWS::DirectoryService::MicrosoftAD: SharedNetworkPhase1 1`] = `Array []`;
815813

816814
exports[`there should not be any unsupported resource changes for AWS::DirectoryService::MicrosoftAD: SharedNetworkPhase1Endpoint0CD50B8FF 1`] = `Array []`;
@@ -819,6 +817,8 @@ exports[`there should not be any unsupported resource changes for AWS::Directory
819817

820818
exports[`there should not be any unsupported resource changes for AWS::DirectoryService::MicrosoftAD: SharedNetworkPhase1Endpoint125DF8CB0 1`] = `Array []`;
821819

820+
exports[`there should not be any unsupported resource changes for AWS::DirectoryService::MicrosoftAD: SharedNetworkPhase1UsEast1 1`] = `Array []`;
821+
822822
exports[`there should not be any unsupported resource changes for AWS::DirectoryService::MicrosoftAD: SharedNetworkPhase1VpcStackCentralB4A762DD 1`] = `Array []`;
823823

824824
exports[`there should not be any unsupported resource changes for AWS::DirectoryService::MicrosoftAD: SharedNetworkPhase1VpcStackDev3F77197C 1`] = `Array []`;
@@ -1072,8 +1072,6 @@ exports[`there should not be any unsupported resource changes for AWS::EC2::Inst
10721072

10731073
exports[`there should not be any unsupported resource changes for AWS::EC2::Instance: SharedNetworkPhase0 1`] = `Array []`;
10741074

1075-
exports[`there should not be any unsupported resource changes for AWS::EC2::Instance: SharedNetworkPhase0UsEast1 1`] = `Array []`;
1076-
10771075
exports[`there should not be any unsupported resource changes for AWS::EC2::Instance: SharedNetworkPhase1 1`] = `Array []`;
10781076

10791077
exports[`there should not be any unsupported resource changes for AWS::EC2::Instance: SharedNetworkPhase1Endpoint0CD50B8FF 1`] = `Array []`;
@@ -1082,6 +1080,8 @@ exports[`there should not be any unsupported resource changes for AWS::EC2::Inst
10821080

10831081
exports[`there should not be any unsupported resource changes for AWS::EC2::Instance: SharedNetworkPhase1Endpoint125DF8CB0 1`] = `Array []`;
10841082

1083+
exports[`there should not be any unsupported resource changes for AWS::EC2::Instance: SharedNetworkPhase1UsEast1 1`] = `Array []`;
1084+
10851085
exports[`there should not be any unsupported resource changes for AWS::EC2::Instance: SharedNetworkPhase1VpcStackCentralB4A762DD 1`] = `Array []`;
10861086

10871087
exports[`there should not be any unsupported resource changes for AWS::EC2::Instance: SharedNetworkPhase1VpcStackDev3F77197C 1`] = `Array []`;
@@ -1205,8 +1205,6 @@ Array [
12051205
]
12061206
`;
12071207

1208-
exports[`there should not be any unsupported resource changes for AWS::EC2::TransitGateway: SharedNetworkPhase0UsEast1 1`] = `Array []`;
1209-
12101208
exports[`there should not be any unsupported resource changes for AWS::EC2::TransitGateway: SharedNetworkPhase1 1`] = `Array []`;
12111209

12121210
exports[`there should not be any unsupported resource changes for AWS::EC2::TransitGateway: SharedNetworkPhase1Endpoint0CD50B8FF 1`] = `Array []`;
@@ -1215,6 +1213,8 @@ exports[`there should not be any unsupported resource changes for AWS::EC2::Tran
12151213

12161214
exports[`there should not be any unsupported resource changes for AWS::EC2::TransitGateway: SharedNetworkPhase1Endpoint125DF8CB0 1`] = `Array []`;
12171215

1216+
exports[`there should not be any unsupported resource changes for AWS::EC2::TransitGateway: SharedNetworkPhase1UsEast1 1`] = `Array []`;
1217+
12181218
exports[`there should not be any unsupported resource changes for AWS::EC2::TransitGateway: SharedNetworkPhase1VpcStackCentralB4A762DD 1`] = `Array []`;
12191219

12201220
exports[`there should not be any unsupported resource changes for AWS::EC2::TransitGateway: SharedNetworkPhase1VpcStackDev3F77197C 1`] = `Array []`;
@@ -1334,8 +1334,6 @@ exports[`there should not be any unsupported resource changes for AWS::ElasticLo
13341334

13351335
exports[`there should not be any unsupported resource changes for AWS::ElasticLoadBalancingV2::LoadBalancer: SharedNetworkPhase0 1`] = `Array []`;
13361336

1337-
exports[`there should not be any unsupported resource changes for AWS::ElasticLoadBalancingV2::LoadBalancer: SharedNetworkPhase0UsEast1 1`] = `Array []`;
1338-
13391337
exports[`there should not be any unsupported resource changes for AWS::ElasticLoadBalancingV2::LoadBalancer: SharedNetworkPhase1 1`] = `Array []`;
13401338

13411339
exports[`there should not be any unsupported resource changes for AWS::ElasticLoadBalancingV2::LoadBalancer: SharedNetworkPhase1Endpoint0CD50B8FF 1`] = `Array []`;
@@ -1344,6 +1342,8 @@ exports[`there should not be any unsupported resource changes for AWS::ElasticLo
13441342

13451343
exports[`there should not be any unsupported resource changes for AWS::ElasticLoadBalancingV2::LoadBalancer: SharedNetworkPhase1Endpoint125DF8CB0 1`] = `Array []`;
13461344

1345+
exports[`there should not be any unsupported resource changes for AWS::ElasticLoadBalancingV2::LoadBalancer: SharedNetworkPhase1UsEast1 1`] = `Array []`;
1346+
13471347
exports[`there should not be any unsupported resource changes for AWS::ElasticLoadBalancingV2::LoadBalancer: SharedNetworkPhase1VpcStackCentralB4A762DD 1`] = `Array []`;
13481348

13491349
exports[`there should not be any unsupported resource changes for AWS::ElasticLoadBalancingV2::LoadBalancer: SharedNetworkPhase1VpcStackDev3F77197C 1`] = `Array []`;
@@ -1529,8 +1529,6 @@ exports[`there should not be any unsupported resource changes for AWS::S3::Bucke
15291529

15301530
exports[`there should not be any unsupported resource changes for AWS::S3::Bucket: SharedNetworkPhase0 1`] = `Array []`;
15311531

1532-
exports[`there should not be any unsupported resource changes for AWS::S3::Bucket: SharedNetworkPhase0UsEast1 1`] = `Array []`;
1533-
15341532
exports[`there should not be any unsupported resource changes for AWS::S3::Bucket: SharedNetworkPhase1 1`] = `
15351533
Array [
15361534
Object {
@@ -1549,6 +1547,8 @@ exports[`there should not be any unsupported resource changes for AWS::S3::Bucke
15491547

15501548
exports[`there should not be any unsupported resource changes for AWS::S3::Bucket: SharedNetworkPhase1Endpoint125DF8CB0 1`] = `Array []`;
15511549

1550+
exports[`there should not be any unsupported resource changes for AWS::S3::Bucket: SharedNetworkPhase1UsEast1 1`] = `Array []`;
1551+
15521552
exports[`there should not be any unsupported resource changes for AWS::S3::Bucket: SharedNetworkPhase1VpcStackCentralB4A762DD 1`] = `Array []`;
15531553

15541554
exports[`there should not be any unsupported resource changes for AWS::S3::Bucket: SharedNetworkPhase1VpcStackDev3F77197C 1`] = `Array []`;
@@ -1724,8 +1724,6 @@ exports[`there should not be any unsupported resource changes for AWS::SecretsMa
17241724

17251725
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::ResourcePolicy: SharedNetworkPhase0 1`] = `Array []`;
17261726

1727-
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::ResourcePolicy: SharedNetworkPhase0UsEast1 1`] = `Array []`;
1728-
17291727
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::ResourcePolicy: SharedNetworkPhase1 1`] = `Array []`;
17301728

17311729
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::ResourcePolicy: SharedNetworkPhase1Endpoint0CD50B8FF 1`] = `Array []`;
@@ -1734,6 +1732,8 @@ exports[`there should not be any unsupported resource changes for AWS::SecretsMa
17341732

17351733
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::ResourcePolicy: SharedNetworkPhase1Endpoint125DF8CB0 1`] = `Array []`;
17361734

1735+
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::ResourcePolicy: SharedNetworkPhase1UsEast1 1`] = `Array []`;
1736+
17371737
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::ResourcePolicy: SharedNetworkPhase1VpcStackCentralB4A762DD 1`] = `Array []`;
17381738

17391739
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::ResourcePolicy: SharedNetworkPhase1VpcStackDev3F77197C 1`] = `Array []`;
@@ -1901,8 +1901,6 @@ exports[`there should not be any unsupported resource changes for AWS::SecretsMa
19011901

19021902
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::Secret: SharedNetworkPhase0 1`] = `Array []`;
19031903

1904-
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::Secret: SharedNetworkPhase0UsEast1 1`] = `Array []`;
1905-
19061904
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::Secret: SharedNetworkPhase1 1`] = `Array []`;
19071905

19081906
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::Secret: SharedNetworkPhase1Endpoint0CD50B8FF 1`] = `Array []`;
@@ -1911,6 +1909,8 @@ exports[`there should not be any unsupported resource changes for AWS::SecretsMa
19111909

19121910
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::Secret: SharedNetworkPhase1Endpoint125DF8CB0 1`] = `Array []`;
19131911

1912+
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::Secret: SharedNetworkPhase1UsEast1 1`] = `Array []`;
1913+
19141914
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::Secret: SharedNetworkPhase1VpcStackCentralB4A762DD 1`] = `Array []`;
19151915

19161916
exports[`there should not be any unsupported resource changes for AWS::SecretsManager::Secret: SharedNetworkPhase1VpcStackDev3F77197C 1`] = `Array []`;

0 commit comments

Comments
 (0)