Add to existing policy instead of creating new one (opensearch-projec…

…t#402) Signed-off-by: Sayali Gaikawad <[email protected]>
peterzhuamazon · Mar 20, 2024 · 766302e · 766302e
1 parent 1d84f53
commit 766302e
Show file tree

Hide file tree

Showing 2 changed files with 80 additions and 6 deletions.
diff --git a/lib/network/ci-external-load-balancer.ts b/lib/network/ci-external-load-balancer.ts
@@ -13,7 +13,7 @@ import {
   ApplicationListener, ApplicationLoadBalancer, ApplicationProtocol, ApplicationTargetGroup, ListenerCertificate, Protocol, SslPolicy,
 } from 'aws-cdk-lib/aws-elasticloadbalancingv2';
 import { PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
-import { Bucket, BucketPolicy } from 'aws-cdk-lib/aws-s3';
+import { Bucket } from 'aws-cdk-lib/aws-s3';
 
 export interface JenkinsExternalLoadBalancerProps {
   readonly vpc: Vpc;
@@ -69,11 +69,7 @@ export class JenkinsExternalLoadBalancer {
 
     this.loadBalancer.logAccessLogs(props.accessLogBucket, accessLoggingPrefix);
 
-    const bucketPolicy = new BucketPolicy(stack, 'ALBaccessLoggingBucketPolicyPErmission', {
-      bucket: props.accessLogBucket,
-    });
-
-    bucketPolicy.document.addStatements(
+    props.accessLogBucket.addToResourcePolicy(
       new PolicyStatement({
         actions: ['s3:PutObject'],
         principals: [

diff --git a/test/ci-stack.test.ts b/test/ci-stack.test.ts
@@ -266,6 +266,84 @@ test('LoadBalancer Access Logging', () => {
   Template.fromStack(stack).hasResourceProperties('AWS::S3::BucketPolicy', {
     PolicyDocument: {
       Statement: [
+        {
+          Action: [
+            's3:PutObject',
+            's3:PutObjectLegalHold',
+            's3:PutObjectRetention',
+            's3:PutObjectTagging',
+            's3:PutObjectVersionTagging',
+            's3:Abort*',
+          ],
+          Effect: 'Allow',
+          Principal: {
+            AWS: {
+              'Fn::Join': [
+                '',
+                [
+                  'arn:',
+                  {
+                    Ref: 'AWS::Partition',
+                  },
+                  ':iam::127311923021:root',
+                ],
+              ],
+            },
+          },
+          Resource: {
+            'Fn::Join': [
+              '',
+              [
+                {
+                  'Fn::GetAtt': [
+                    'jenkinsAuditBucket110D3080',
+                    'Arn',
+                  ],
+                },
+                '/loadBalancerAccessLogs/AWSLogs/test-account/*',
+              ],
+            ],
+          },
+        },
+        {
+          Action: 's3:PutObject',
+          Condition: {
+            StringEquals: {
+              's3:x-amz-acl': 'bucket-owner-full-control',
+            },
+          },
+          Effect: 'Allow',
+          Principal: {
+            Service: 'delivery.logs.amazonaws.com',
+          },
+          Resource: {
+            'Fn::Join': [
+              '',
+              [
+                {
+                  'Fn::GetAtt': [
+                    'jenkinsAuditBucket110D3080',
+                    'Arn',
+                  ],
+                },
+                '/loadBalancerAccessLogs/AWSLogs/test-account/*',
+              ],
+            ],
+          },
+        },
+        {
+          Action: 's3:GetBucketAcl',
+          Effect: 'Allow',
+          Principal: {
+            Service: 'delivery.logs.amazonaws.com',
+          },
+          Resource: {
+            'Fn::GetAtt': [
+              'jenkinsAuditBucket110D3080',
+              'Arn',
+            ],
+          },
+        },
         {
           Action: 's3:PutObject',
           Effect: 'Allow',