feat(opensearchservice): create `AWS::Logs::ResourcePolicy` instead of `Custom::CloudwatchLogResourcePolicy` #34558

wafuwafu13 · 2025-05-26T20:07:49Z

Issue

Related #5343

Reason for this change

We don't need to create a custom resource to set the log group resource policy since it is supported by CDK and cfn.

aws-cdk/packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts

Lines 1880 to 1886 in 54e8222

    
           // Use a custom resource to set the log group resource policy since it is not supported by CDK and cfn. 
        
           // https://github.com/aws/aws-cdk/issues/5343 
        
           logGroupResourcePolicy = new LogGroupResourcePolicy(this, `ESLogGroupPolicy${this.node.addr}`, { 
        
             // create a cloudwatch logs resource policy name that is unique to this domain instance 
        
             policyName: `ESLogPolicy${this.node.addr}`, 
        
             policyStatements: [logPolicyStatement], 
        
           });

Description of changes

Create feature flag
Use new logs.ResourcePolicy instead of new LogGroupResourcePolicy when feature flag is set

Describe any new or updated permissions being added

None

Description of how you validated changes

Pass unit/integ tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…ustom::CloudwatchLogResourcePolicy

aws-cdk-automation

(This review is outdated)

wafuwafu13 · 2025-05-26T20:40:15Z

Exemption Request

integration test is updated

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aemada-aws · 2025-06-17T12:20:41Z

packages/aws-cdk-lib/aws-opensearchservice/lib/domain.ts

-      // Use a custom resource to set the log group resource policy since it is not supported by CDK and cfn.
-      // https://github.com/aws/aws-cdk/issues/5343
-      logGroupResourcePolicy = new LogGroupResourcePolicy(this, `ESLogGroupPolicy${this.node.addr}`, {
+      logGroupResourcePolicy = new logs.ResourcePolicy(this, `ESLogGroupPolicy${this.node.addr}`, {


Thanks for the contribution. This change is considered a breaking change because:

There is a possible conflict as CFN tries to create the resource policy before deleting the custom resource, resulting in a resource policy with the same name already exists error.

Deleting the custom resource first will cause a temporary period where permissions on the logs are lost, as on the delete lifecycle event of the custom resource we remove the policy. Ref:

aws-cdk/packages/aws-cdk-lib/aws-opensearchservice/lib/log-group-resource-policy.ts

Lines 39 to 46 in 54e8222

onDelete: {

service: 'CloudWatchLogs',

action: 'deleteResourcePolicy',

parameters: {

policyName: props.policyName,

},

ignoreErrorCodesMatching: 'ResourceNotFoundException',

},

Therefore we should add a feature flag for this feature with recommended migration steps, and we can default it to enabled for new CDK projects, but we can't automatically enable this for existing cdk projects.

Thanks for reviewing. I added a feature flag.

wafuwafu13 · 2025-06-25T13:49:38Z

memo: example of feature flag
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md#aws-cdkaws-route53-targetsuserpooldomainnamemethodwithoutcustomresource

…ogresourcepolicy

Pull request has been modified.

aemada-aws · 2025-07-03T12:40:04Z

packages/aws-cdk-lib/cx-api/lib/features.ts

+
+  //////////////////////////////////////////////////////////////////////
+  [OPENSEARCHSERVICE_LOG_GROUP_RESOURCE_POLICY_WITHOUT_CUSTOM_RESOURCE]: {
+    type: FlagType.BugFix,


this is a feature, not a bug fix.

Please also rename the PR to indicate a feature, as this directly in the change log. Technically we are not fixing a bug in the previous implementation, we are improving it by using the L1 resource.

aemada-aws · 2025-07-03T12:41:39Z

packages/aws-cdk-lib/cx-api/lib/features.ts

@@ -1660,6 +1661,19 @@ export const FLAGS: Record<string, FlagInfo> = {
    recommendedValue: true,
    compatibilityWithOldBehaviorMd: 'Disable the feature flag to let lambda service create logGroup or specify logGroup or logRetention',
  },
+
+  //////////////////////////////////////////////////////////////////////
+  [OPENSEARCHSERVICE_LOG_GROUP_RESOURCE_POLICY_WITHOUT_CUSTOM_RESOURCE]: {


Suggested change

[OPENSEARCHSERVICE_LOG_GROUP_RESOURCE_POLICY_WITHOUT_CUSTOM_RESOURCE]: {

[OPENSEARCHSERVICE_CREATE_CLOUDFORMATION_RESOURCE_POLICY]: {

aemada-aws · 2025-07-03T12:43:20Z

packages/aws-cdk-lib/cx-api/lib/features.ts

+  //////////////////////////////////////////////////////////////////////
+  [OPENSEARCHSERVICE_LOG_GROUP_RESOURCE_POLICY_WITHOUT_CUSTOM_RESOURCE]: {
+    type: FlagType.BugFix,
+    summary: 'When enabled, create log group resource policy without creating a custom resource.',


summary: 'When enabled, adds a log group resource policy using AWS::Logs::ResourcePolicy, without relying on a custom resource.,

…ogresourcepolicy

Pull request has been modified.

aws-cdk-automation · 2025-07-05T21:03:25Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: d82b2e3
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

fix(opensearchservice): create AWS::Logs::ResourcePolicy instead of C…

c3577d9

…ustom::CloudwatchLogResourcePolicy

aws-cdk-automation requested a review from a team May 26, 2025 20:07

github-actions bot added p2 admired-contributor [Pilot] contributed between 13-24 PRs to the CDK labels May 26, 2025

aws-cdk-automation previously requested changes May 26, 2025

View reviewed changes

aws-cdk-automation added pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels May 26, 2025

github-actions bot mentioned this pull request Jun 1, 2025

Monthly PR metrics report #34601

Open

Abogical added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Jun 2, 2025

aemada-aws self-assigned this Jun 17, 2025

aemada-aws self-requested a review June 17, 2025 12:20

aemada-aws previously requested changes Jun 17, 2025

View reviewed changes

Merge remote-tracking branch 'upstream/main' into opensearchservice-l…

2f69d66

…ogresourcepolicy

wafuwafu13 marked this pull request as draft June 25, 2025 16:06

fix: add feature flag

e2c0bb2

wafuwafu13 requested a deployment to test-pipeline June 26, 2025 14:10 — with GitHub Actions Waiting

wafuwafu13 marked this pull request as ready for review June 26, 2025 14:11

wafuwafu13 requested a review from aemada-aws June 26, 2025 14:54

aemada-aws previously requested changes Jul 3, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 3, 2025

wafuwafu13 changed the title ~~fix(opensearchservice): create AWS::Logs::ResourcePolicy instead of Custom::CloudwatchLogResourcePolicy~~ feat(opensearchservice): create AWS::Logs::ResourcePolicy instead of Custom::CloudwatchLogResourcePolicy Jul 5, 2025

Merge remote-tracking branch 'upstream/main' into opensearchservice-l…

bc2bd09

…ogresourcepolicy

wafuwafu13 requested a deployment to test-pipeline July 5, 2025 20:06 — with GitHub Actions Waiting

fix: change flag description

aec5d3b

wafuwafu13 requested a deployment to test-pipeline July 5, 2025 20:08 — with GitHub Actions Waiting

docs: add compatibilityWithOldBehaviorMd

d82b2e3

wafuwafu13 requested a deployment to test-pipeline July 5, 2025 20:32 — with GitHub Actions Waiting

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 5, 2025

wafuwafu13 requested a review from aemada-aws July 6, 2025 08:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(opensearchservice): create `AWS::Logs::ResourcePolicy` instead of `Custom::CloudwatchLogResourcePolicy` #34558

feat(opensearchservice): create `AWS::Logs::ResourcePolicy` instead of `Custom::CloudwatchLogResourcePolicy` #34558

Uh oh!

wafuwafu13 commented May 26, 2025 •

edited

Loading

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

wafuwafu13 commented May 26, 2025

Uh oh!

aemada-aws Jun 17, 2025

Uh oh!

wafuwafu13 Jun 26, 2025

Uh oh!

wafuwafu13 commented Jun 25, 2025

Uh oh!

aemada-aws Jul 3, 2025

Uh oh!

aemada-aws Jul 3, 2025

Uh oh!

aemada-aws Jul 3, 2025

Uh oh!

aemada-aws Jul 3, 2025

Uh oh!

aws-cdk-automation commented Jul 5, 2025

Uh oh!

Uh oh!

	// Use a custom resource to set the log group resource policy since it is not supported by CDK and cfn.
	// https://github.com/aws/aws-cdk/issues/5343
	logGroupResourcePolicy = new LogGroupResourcePolicy(this, `ESLogGroupPolicy${this.node.addr}`, {
	// create a cloudwatch logs resource policy name that is unique to this domain instance
	policyName: `ESLogPolicy${this.node.addr}`,
	policyStatements: [logPolicyStatement],
	});

	onDelete: {
	service: 'CloudWatchLogs',
	action: 'deleteResourcePolicy',
	parameters: {
	policyName: props.policyName,
	},
	ignoreErrorCodesMatching: 'ResourceNotFoundException',
	},

	[OPENSEARCHSERVICE_LOG_GROUP_RESOURCE_POLICY_WITHOUT_CUSTOM_RESOURCE]: {
	[OPENSEARCHSERVICE_CREATE_CLOUDFORMATION_RESOURCE_POLICY]: {

feat(opensearchservice): create AWS::Logs::ResourcePolicy instead of Custom::CloudwatchLogResourcePolicy #34558

Are you sure you want to change the base?

feat(opensearchservice): create AWS::Logs::ResourcePolicy instead of Custom::CloudwatchLogResourcePolicy #34558

Uh oh!

Conversation

wafuwafu13 commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wafuwafu13 commented May 26, 2025

Uh oh!

aemada-aws Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

wafuwafu13 Jun 26, 2025

Choose a reason for hiding this comment

Uh oh!

wafuwafu13 commented Jun 25, 2025

Uh oh!

aemada-aws Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

aemada-aws Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

aemada-aws Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

aemada-aws Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation commented Jul 5, 2025

AWS CodeBuild CI Report

Uh oh!

Uh oh!

feat(opensearchservice): create `AWS::Logs::ResourcePolicy` instead of `Custom::CloudwatchLogResourcePolicy` #34558

feat(opensearchservice): create `AWS::Logs::ResourcePolicy` instead of `Custom::CloudwatchLogResourcePolicy` #34558

wafuwafu13 commented May 26, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading