Skip to content

Commit f7a4e8e

Browse files
mickychettamickychetta
committed
added logS3AccessLogs and s3BucketInterface to s3-step-function
1 parent 8134b6f commit f7a4e8e

15 files changed

+50
-1663
lines changed

‎source/patterns/@aws-solutions-constructs/aws-s3-step-function/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ _Parameters_
6363
|createCloudWatchAlarms|`boolean`|Whether to create recommended CloudWatch alarms|
6464
|logGroupProps?|[`logs.LogGroupProps`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-logs.LogGroupProps.html)|User provided props to override the default props for for the CloudWatchLogs LogGroup.|
6565
|loggingBucketProps?|[`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.BucketProps.html)|Optional user provided props to override the default props for the S3 Logging Bucket.|
66+
|logS3AccessLogs?| boolean|Whether to turn on Access Logging for the S3 bucket. Creates an S3 bucket with associated storage costs for the logs. Enabling Access Logging is a best practice. default - true|
6667

6768
## Pattern Properties
6869

@@ -76,7 +77,7 @@ _Parameters_
7677
|cloudtrail|[`cloudtrail.Trail`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-cloudtrail.Trail.html)|Returns an instance of the cloudtrail.Trail created by the construct|
7778
|cloudtrailBucket|[`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.Bucket.html)|Returns an instance of the s3.Bucket created by the construct for CloudTrail|
7879
|cloudtrailLoggingBucket|[`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.Bucket.html)|Returns an instance of s3.Bucket created by the construct as the logging bucket for the primary CloudTrail bucket.|
79-
80+
|s3BucketInterface|[`s3.IBucket`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.IBucket.html)|Returns an instance of s3.IBucket created by the construct.|
8081
## Default settings
8182

8283
Out of the box implementation of the Construct without any override will set the following defaults:

‎source/patterns/@aws-solutions-constructs/aws-s3-step-function/lib/index.ts

+12-3
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ export interface S3ToStepFunctionProps {
4848
*
4949
* @default - None
5050
*/
51-
readonly eventRuleProps?: events.RuleProps;
51+
readonly eventRuleProps?: events.RuleProps,
5252
/**
5353
* Whether to deploy a Trail in AWS CloudTrail to log API events in Amazon S3
5454
*
@@ -66,13 +66,20 @@ export interface S3ToStepFunctionProps {
6666
*
6767
* @default - Default props are used
6868
*/
69-
readonly logGroupProps?: logs.LogGroupProps
69+
readonly logGroupProps?: logs.LogGroupProps,
7070
/**
7171
* Optional user provided props to override the default props for the S3 Logging Bucket.
7272
*
7373
* @default - Default props are used
7474
*/
75-
readonly loggingBucketProps?: s3.BucketProps
75+
readonly loggingBucketProps?: s3.BucketProps,
76+
/**
77+
* Whether to turn on Access Logs for the S3 bucket with the associated storage costs.
78+
* Enabling Access Logging is a best practice.
79+
*
80+
* @default - true
81+
*/
82+
readonly logS3AccessLogs?: boolean;
7683
}
7784

7885
export class S3ToStepFunction extends Construct {
@@ -84,6 +91,7 @@ export class S3ToStepFunction extends Construct {
8491
public readonly cloudtrail?: cloudtrail.Trail;
8592
public readonly cloudtrailBucket?: s3.Bucket;
8693
public readonly cloudtrailLoggingBucket?: s3.Bucket;
94+
public readonly s3BucketInterface: s3.IBucket;
8795

8896
/**
8997
* @summary Constructs a new instance of the S3ToStepFunction class.
@@ -110,5 +118,6 @@ export class S3ToStepFunction extends Construct {
110118
this.cloudtrail = wrappedConstruct.cloudtrail;
111119
this.cloudtrailBucket = wrappedConstruct.cloudtrailBucket;
112120
this.cloudtrailLoggingBucket = wrappedConstruct.cloudtrailLoggingBucket;
121+
this.s3BucketInterface = wrappedConstruct.s3BucketInterface;
113122
}
114123
}

‎source/patterns/@aws-solutions-constructs/aws-s3-step-function/test/integ.customLoggingBucket.expected.json

+2-262
Original file line numberDiff line numberDiff line change
@@ -176,273 +176,13 @@
176176
}
177177
}
178178
},
179-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3LoggingBucket449D5AB7": {
180-
"Type": "AWS::S3::Bucket",
181-
"Properties": {
182-
"AccessControl": "LogDeliveryWrite",
183-
"BucketEncryption": {
184-
"ServerSideEncryptionConfiguration": [
185-
{
186-
"ServerSideEncryptionByDefault": {
187-
"SSEAlgorithm": "AES256"
188-
}
189-
}
190-
]
191-
},
192-
"PublicAccessBlockConfiguration": {
193-
"BlockPublicAcls": true,
194-
"BlockPublicPolicy": true,
195-
"IgnorePublicAcls": true,
196-
"RestrictPublicBuckets": true
197-
},
198-
"VersioningConfiguration": {
199-
"Status": "Enabled"
200-
}
201-
},
202-
"UpdateReplacePolicy": "Retain",
203-
"DeletionPolicy": "Retain",
204-
"Metadata": {
205-
"cfn_nag": {
206-
"rules_to_suppress": [
207-
{
208-
"id": "W35",
209-
"reason": "This S3 bucket is used as the access logging bucket for another bucket"
210-
}
211-
]
212-
}
213-
}
214-
},
215-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3LoggingBucketPolicy7547A73F": {
216-
"Type": "AWS::S3::BucketPolicy",
217-
"Properties": {
218-
"Bucket": {
219-
"Ref": "tests3stepfunctiontests3stepfunctionWCloudTrailS3LoggingBucket449D5AB7"
220-
},
221-
"PolicyDocument": {
222-
"Statement": [
223-
{
224-
"Action": "*",
225-
"Condition": {
226-
"Bool": {
227-
"aws:SecureTransport": "false"
228-
}
229-
},
230-
"Effect": "Deny",
231-
"Principal": {
232-
"AWS": "*"
233-
},
234-
"Resource": [
235-
{
236-
"Fn::Join": [
237-
"",
238-
[
239-
{
240-
"Fn::GetAtt": [
241-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3LoggingBucket449D5AB7",
242-
"Arn"
243-
]
244-
},
245-
"/*"
246-
]
247-
]
248-
},
249-
{
250-
"Fn::GetAtt": [
251-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3LoggingBucket449D5AB7",
252-
"Arn"
253-
]
254-
}
255-
],
256-
"Sid": "HttpsOnly"
257-
}
258-
],
259-
"Version": "2012-10-17"
260-
}
261-
}
262-
},
263-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3Bucket24C50489": {
264-
"Type": "AWS::S3::Bucket",
265-
"Properties": {
266-
"BucketEncryption": {
267-
"ServerSideEncryptionConfiguration": [
268-
{
269-
"ServerSideEncryptionByDefault": {
270-
"SSEAlgorithm": "AES256"
271-
}
272-
}
273-
]
274-
},
275-
"LifecycleConfiguration": {
276-
"Rules": [
277-
{
278-
"NoncurrentVersionTransitions": [
279-
{
280-
"StorageClass": "GLACIER",
281-
"TransitionInDays": 90
282-
}
283-
],
284-
"Status": "Enabled"
285-
}
286-
]
287-
},
288-
"LoggingConfiguration": {
289-
"DestinationBucketName": {
290-
"Ref": "tests3stepfunctiontests3stepfunctionWCloudTrailS3LoggingBucket449D5AB7"
291-
}
292-
},
293-
"PublicAccessBlockConfiguration": {
294-
"BlockPublicAcls": true,
295-
"BlockPublicPolicy": true,
296-
"IgnorePublicAcls": true,
297-
"RestrictPublicBuckets": true
298-
},
299-
"VersioningConfiguration": {
300-
"Status": "Enabled"
301-
}
302-
},
303-
"UpdateReplacePolicy": "Retain",
304-
"DeletionPolicy": "Retain"
305-
},
306-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3BucketPolicy9ACF9ADC": {
307-
"Type": "AWS::S3::BucketPolicy",
308-
"Properties": {
309-
"Bucket": {
310-
"Ref": "tests3stepfunctiontests3stepfunctionWCloudTrailS3Bucket24C50489"
311-
},
312-
"PolicyDocument": {
313-
"Statement": [
314-
{
315-
"Action": "*",
316-
"Condition": {
317-
"Bool": {
318-
"aws:SecureTransport": "false"
319-
}
320-
},
321-
"Effect": "Deny",
322-
"Principal": {
323-
"AWS": "*"
324-
},
325-
"Resource": [
326-
{
327-
"Fn::Join": [
328-
"",
329-
[
330-
{
331-
"Fn::GetAtt": [
332-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3Bucket24C50489",
333-
"Arn"
334-
]
335-
},
336-
"/*"
337-
]
338-
]
339-
},
340-
{
341-
"Fn::GetAtt": [
342-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3Bucket24C50489",
343-
"Arn"
344-
]
345-
}
346-
],
347-
"Sid": "HttpsOnly"
348-
},
349-
{
350-
"Action": "s3:GetBucketAcl",
351-
"Effect": "Allow",
352-
"Principal": {
353-
"Service": "cloudtrail.amazonaws.com"
354-
},
355-
"Resource": {
356-
"Fn::GetAtt": [
357-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3Bucket24C50489",
358-
"Arn"
359-
]
360-
}
361-
},
362-
{
363-
"Action": "s3:PutObject",
364-
"Condition": {
365-
"StringEquals": {
366-
"s3:x-amz-acl": "bucket-owner-full-control"
367-
}
368-
},
369-
"Effect": "Allow",
370-
"Principal": {
371-
"Service": "cloudtrail.amazonaws.com"
372-
},
373-
"Resource": {
374-
"Fn::Join": [
375-
"",
376-
[
377-
{
378-
"Fn::GetAtt": [
379-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3Bucket24C50489",
380-
"Arn"
381-
]
382-
},
383-
"/AWSLogs/",
384-
{
385-
"Ref": "AWS::AccountId"
386-
},
387-
"/*"
388-
]
389-
]
390-
}
391-
}
392-
],
393-
"Version": "2012-10-17"
394-
}
395-
}
396-
},
397-
"tests3stepfunctiontests3stepfunctionWS3EventsTrailA0FDE626": {
398-
"Type": "AWS::CloudTrail::Trail",
399-
"Properties": {
400-
"IsLogging": true,
401-
"S3BucketName": {
402-
"Ref": "tests3stepfunctiontests3stepfunctionWCloudTrailS3Bucket24C50489"
403-
},
404-
"EnableLogFileValidation": true,
405-
"EventSelectors": [
406-
{
407-
"DataResources": [
408-
{
409-
"Type": "AWS::S3::Object",
410-
"Values": [
411-
{
412-
"Fn::Join": [
413-
"",
414-
[
415-
{
416-
"Fn::GetAtt": [
417-
"tests3stepfunctiontests3stepfunctionWS3Bucket9BE64924",
418-
"Arn"
419-
]
420-
},
421-
"/"
422-
]
423-
]
424-
}
425-
]
426-
}
427-
],
428-
"IncludeManagementEvents": false,
429-
"ReadWriteType": "All"
430-
}
431-
],
432-
"IncludeGlobalServiceEvents": true,
433-
"IsMultiRegionTrail": true
434-
},
435-
"DependsOn": [
436-
"tests3stepfunctiontests3stepfunctionWCloudTrailS3BucketPolicy9ACF9ADC"
437-
]
438-
},
439179
"tests3stepfunctiontests3stepfunctionWtests3stepfunctionWeventrulestepfunctionconstructStateMachineLogGroupE83EECDD": {
440180
"Type": "AWS::Logs::LogGroup",
441181
"Properties": {
442182
"LogGroupName": "/aws/vendedlogs/states/customloggingbuckettests3stepfunctionweventrulestepfunctionconstructstatemachinelog0a1bbb9b57e8"
443183
},
444-
"UpdateReplacePolicy": "Retain",
445-
"DeletionPolicy": "Retain",
184+
"UpdateReplacePolicy": "Delete",
185+
"DeletionPolicy": "Delete",
446186
"Metadata": {
447187
"cfn_nag": {
448188
"rules_to_suppress": [

‎source/patterns/@aws-solutions-constructs/aws-s3-step-function/test/integ.customLoggingBucket.ts

+5-1
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ new S3ToStepFunction(stack, 'test-s3-step-function', {
3737
bucketName: 'custom-logging-bucket',
3838
encryption: BucketEncryption.S3_MANAGED,
3939
versioned: true
40-
}
40+
},
41+
logGroupProps: {
42+
removalPolicy: RemovalPolicy.DESTROY
43+
},
44+
deployCloudTrail: false
4145
});
4246
app.synth();

0 commit comments

Comments
 (0)