aws-events-target: support adding CloudWatchLogGroup rule target without creation of new Resource Policy

[gwaltneyluke]

Describe the feature

The user should be able to override the creation of a new CloudWatch Log Resource Policy when defining a Log Group as the target of an EventBridge rule.

Use Case

When a CloudWatch LogGroup is defined as the target of an EventBridge rule, CDK creates a CloudWatch Log Resource Policy in order to allow EventBridge to write events to CloudWatch. Since there is a hard limit of 10 CloudWatch Log Resource Policies per account per region, this is limiting the amount of EventBridge rules that can be logged to CloudWatch, especially considering one Resource Policy should be able to dictate access to EventBridge to write to several Log Groups.

Consider the following policies that were created by CDK:

{
    "policyName": "mycdkappEventsLogGroupPolicymycdkappRule1D26B095CB8287BF4",
    "policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"events.amazonaws.com\"},\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Resource\":\"arn:aws:logs:us-east-1:*:log-group:/aws/events/rule-1-messages:*\"}]}",
    "lastUpdatedTime": 1725997880957
},
{
    "policyName": "mycdkappEventsLogGroupPolicymycdkappRule278393ACD2E613614",
    "policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"events.amazonaws.com\"},\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Resource\":\"arn:aws:logs:us-east-1:*:log-group:/aws/events/rule-2-messages:*\"}]}",
    "lastUpdatedTime": 1725997881143
},
{
    "policyName": "mycdkappEventsLogGroupPolicymycdkappRule35B273849B4FB4310",
    "policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"events.amazonaws.com\"},\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Resource\":\"arn:aws:logs:us-east-1:*:log-group:/aws/events/rule-3-messages:*\"}]}",
    "lastUpdatedTime": 1725997880890
}

These three CloudWatch Logs Resource Policies can be simplified and replaced by just one policy:

{
    "policyName": "TrustEventsToStoreLogEvents",
    "policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"TrustEventsToStoreLogEvent\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"delivery.logs.amazonaws.com\",\"events.amazonaws.com\"]},\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":\"arn:aws:logs:us-east-1:*:log-group:/aws/events/*:*\"}]}",
    "lastUpdatedTime": 1721857860333
}

Proposed Solution

A property could be added to LogGroupProps interface (below) which allows the consumer to opt out of the Resource Policy creation.

aws-cdk/packages/aws-cdk-lib/aws-events-targets/lib/log-group.ts

Lines 62 to 89 in 1e20375

	export interface LogGroupProps extends TargetBaseProps {
	/**
	* The event to send to the CloudWatch LogGroup
	*
	* This will be the event logged into the CloudWatch LogGroup
	*
	* @default - the entire EventBridge event
	* @deprecated use logEvent instead
	*/
	readonly event?: events.RuleTargetInput;
	/**
	* The event to send to the CloudWatch LogGroup
	*
	* This will be the event logged into the CloudWatch LogGroup
	*
	* @default - the entire EventBridge event
	*/
	readonly logEvent?: LogGroupTargetInput;
	/**
	* Whether the custom resource created wll default to
	* install latest AWS SDK
	*
	* @default - install latest AWS SDK
	*/
	readonly installLatestAwsSdk?: boolean;
	}

Then in the if statement (below) which checks for the existence of the Resource Policy CDK is trying to create, a condition could be added to that check to see whether the new property is true or false.

aws-cdk/packages/aws-cdk-lib/aws-events-targets/lib/log-group.ts

Lines 118 to 128 in 1e20375

	if (!this.logGroup.node.tryFindChild(resourcePolicyId)) {
	new LogGroupResourcePolicy(logGroupStack, resourcePolicyId, {
	installLatestAwsSdk: this.props.installLatestAwsSdk,
	policyStatements: [new iam.PolicyStatement({
	effect: iam.Effect.ALLOW,
	actions: ['logs:PutLogEvents', 'logs:CreateLogStream'],
	resources: [this.logGroup.logGroupArn],
	principals: [new iam.ServicePrincipal('events.amazonaws.com')],
	})],
	});
	}

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.157.0

Environment details (OS name and version, etc.)

macOS Ventura 13.4 (Intel processor)

[rogerchi]

Just ran into this today as well.

[frankpengau]

I think @TheRealAmazonKendra might be looking into issues surrounding that, based off my issue raised from last time.

Ref: #30428

[ashishdhingra]

I think @TheRealAmazonKendra might be looking into issues surrounding that, based off my issue raised from last time.

Ref: #30428

@frankpengau Thanks for the reference. CloudWatch Logs quotas also specifies Up to 10 CloudWatch Logs resource policies per Region per account. This quota can't be changed..