aws_s3: Starting April 2023, it's not possible to setup an s3 bucket to use as logging bucket for a cloudfront distribution

[ben-elsen]

Describe the feature

At the moment, it is not possible to create a bucket with aws_cdk that can be used in a cloudfront distribution as logging bucket.

There was the announcement of AWS: Starting April 2023 you will need to enable S3 access control lists (ACLs) for new S3 buckets being used for CloudFront standard logs. (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html)

I don't think there is a way to do this with CDK at the moment, every configuration I use, I get the following error:
ROLLBACK_COMPLETE: Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting (Service: Amazon S3; Status Code: 400; Error Code: InvalidBucketAclWithObjectOwnership;

Use Case

I want to be able to define a s3 bucket and use it as logging bucket for a cloudfront distribution.

Proposed Solution

I think a new type for BucketAccessControl could help?

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.76.0 (build 78c411b)

Environment details (OS name and version, etc.)

Macbook Ventura 13.3.1 (22E261)

[pahud]

related to #25288 (comment)

And this works for me FYR

const logBucket = new s3.Bucket(this, 'logBucket', {
  objectOwnership: s3.ObjectOwnership.OBJECT_WRITER,
});

We probably need to improve our API document for this.

ref: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#AccessLogsBucketAndFileOwnership

[rittneje]

We are facing the same issue trying to use a bucket for the server access logs of another bucket. According to the docs the recommendation is to use an IAM policy instead of an ACL. CDK ought to be fixed to follow this security best practice. https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html#grant-log-delivery-permissions-bucket-policy

[ben-elsen]

Thanks @pahud this seems to work for us!

[corymhall]

I'm going to close this in favor of #25358

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.