Skip to content

Commit f2babd9

Browse files
awslukeguanawslukeguan
authored
feat: set log retention of all CDK-vended custom resources with CustomResourceConfig (#31041)
### Reason for this change CDK vended custom resources may or may not have Cloudwatch logGroup set with a retention period. Modify all CDK-vended custom resources with `CustomResourceConfig` and to modify retention period with `addLogRetentionLifetime` method. `CustomResourceConfig.of(app).addLogRetentionLifetime(logs.RetentionDays.TEN_YEARS);` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 9acd528 commit f2babd9

File tree

53 files changed

+5190
-3
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+5190
-3
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/custom-resources/test/custom-resource-config/integ.custom-resource-config-logGroup.js.snapshot/MyStack.assets.json

+58
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/custom-resources/test/custom-resource-config/integ.custom-resource-config-logGroup.js.snapshot/MyStack.template.json

+263
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,263 @@
1+
{
2+
"Resources": {
3+
"WebsiteBucket75C24D94": {
4+
"Type": "AWS::S3::Bucket",
5+
"Properties": {
6+
"Tags": [
7+
{
8+
"Key": "aws-cdk:cr-owned:156aa6de",
9+
"Value": "true"
10+
}
11+
]
12+
},
13+
"UpdateReplacePolicy": "Retain",
14+
"DeletionPolicy": "Retain"
15+
},
16+
"LogGroupF5B46931": {
17+
"Type": "AWS::Logs::LogGroup",
18+
"Properties": {
19+
"RetentionInDays": 3653
20+
},
21+
"UpdateReplacePolicy": "Retain",
22+
"DeletionPolicy": "Retain"
23+
},
24+
"s3deployAwsCliLayerD0CD1E6B": {
25+
"Type": "AWS::Lambda::LayerVersion",
26+
"Properties": {
27+
"Content": {
28+
"S3Bucket": {
29+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
30+
},
31+
"S3Key": "3322b7049fb0ed2b7cbb644a2ada8d1116ff80c32dca89e6ada846b5de26f961.zip"
32+
},
33+
"Description": "/opt/awscli/aws"
34+
}
35+
},
36+
"s3deployCustomResourceDB97D82D": {
37+
"Type": "Custom::CDKBucketDeployment",
38+
"Properties": {
39+
"ServiceToken": {
40+
"Fn::GetAtt": [
41+
"CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C81C01536",
42+
"Arn"
43+
]
44+
},
45+
"SourceBucketNames": [
46+
{
47+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
48+
}
49+
],
50+
"SourceObjectKeys": [
51+
"561a8b95d6d62d87513e3607a2de271376251555ee83cf7b93534b0e85c500c8.zip"
52+
],
53+
"SourceMarkers": [
54+
{}
55+
],
56+
"DestinationBucketName": {
57+
"Ref": "WebsiteBucket75C24D94"
58+
},
59+
"Prune": true
60+
},
61+
"UpdateReplacePolicy": "Delete",
62+
"DeletionPolicy": "Delete"
63+
},
64+
"CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265": {
65+
"Type": "AWS::IAM::Role",
66+
"Properties": {
67+
"AssumeRolePolicyDocument": {
68+
"Statement": [
69+
{
70+
"Action": "sts:AssumeRole",
71+
"Effect": "Allow",
72+
"Principal": {
73+
"Service": "lambda.amazonaws.com"
74+
}
75+
}
76+
],
77+
"Version": "2012-10-17"
78+
},
79+
"ManagedPolicyArns": [
80+
{
81+
"Fn::Join": [
82+
"",
83+
[
84+
"arn:",
85+
{
86+
"Ref": "AWS::Partition"
87+
},
88+
":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
89+
]
90+
]
91+
}
92+
]
93+
}
94+
},
95+
"CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRoleDefaultPolicy88902FDF": {
96+
"Type": "AWS::IAM::Policy",
97+
"Properties": {
98+
"PolicyDocument": {
99+
"Statement": [
100+
{
101+
"Action": [
102+
"s3:GetBucket*",
103+
"s3:GetObject*",
104+
"s3:List*"
105+
],
106+
"Effect": "Allow",
107+
"Resource": [
108+
{
109+
"Fn::Join": [
110+
"",
111+
[
112+
"arn:",
113+
{
114+
"Ref": "AWS::Partition"
115+
},
116+
":s3:::",
117+
{
118+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
119+
},
120+
"/*"
121+
]
122+
]
123+
},
124+
{
125+
"Fn::Join": [
126+
"",
127+
[
128+
"arn:",
129+
{
130+
"Ref": "AWS::Partition"
131+
},
132+
":s3:::",
133+
{
134+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
135+
}
136+
]
137+
]
138+
}
139+
]
140+
},
141+
{
142+
"Action": [
143+
"s3:Abort*",
144+
"s3:DeleteObject*",
145+
"s3:GetBucket*",
146+
"s3:GetObject*",
147+
"s3:List*",
148+
"s3:PutObject",
149+
"s3:PutObjectLegalHold",
150+
"s3:PutObjectRetention",
151+
"s3:PutObjectTagging",
152+
"s3:PutObjectVersionTagging"
153+
],
154+
"Effect": "Allow",
155+
"Resource": [
156+
{
157+
"Fn::GetAtt": [
158+
"WebsiteBucket75C24D94",
159+
"Arn"
160+
]
161+
},
162+
{
163+
"Fn::Join": [
164+
"",
165+
[
166+
{
167+
"Fn::GetAtt": [
168+
"WebsiteBucket75C24D94",
169+
"Arn"
170+
]
171+
},
172+
"/*"
173+
]
174+
]
175+
}
176+
]
177+
}
178+
],
179+
"Version": "2012-10-17"
180+
},
181+
"PolicyName": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRoleDefaultPolicy88902FDF",
182+
"Roles": [
183+
{
184+
"Ref": "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265"
185+
}
186+
]
187+
}
188+
},
189+
"CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C81C01536": {
190+
"Type": "AWS::Lambda::Function",
191+
"Properties": {
192+
"Code": {
193+
"S3Bucket": {
194+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
195+
},
196+
"S3Key": "0158f40002a8c211635388a87874fd4dcc3d68f525fe08a0fe0f014069ae539c.zip"
197+
},
198+
"Environment": {
199+
"Variables": {
200+
"AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
201+
}
202+
},
203+
"Handler": "index.handler",
204+
"Layers": [
205+
{
206+
"Ref": "s3deployAwsCliLayerD0CD1E6B"
207+
}
208+
],
209+
"LoggingConfig": {
210+
"LogGroup": {
211+
"Ref": "LogGroupF5B46931"
212+
}
213+
},
214+
"Role": {
215+
"Fn::GetAtt": [
216+
"CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
217+
"Arn"
218+
]
219+
},
220+
"Runtime": "python3.9",
221+
"Timeout": 900
222+
},
223+
"DependsOn": [
224+
"CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRoleDefaultPolicy88902FDF",
225+
"CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265"
226+
]
227+
}
228+
},
229+
"Parameters": {
230+
"BootstrapVersion": {
231+
"Type": "AWS::SSM::Parameter::Value<String>",
232+
"Default": "/cdk-bootstrap/hnb659fds/version",
233+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
234+
}
235+
},
236+
"Rules": {
237+
"CheckBootstrapVersion": {
238+
"Assertions": [
239+
{
240+
"Assert": {
241+
"Fn::Not": [
242+
{
243+
"Fn::Contains": [
244+
[
245+
"1",
246+
"2",
247+
"3",
248+
"4",
249+
"5"
250+
],
251+
{
252+
"Ref": "BootstrapVersion"
253+
}
254+
]
255+
}
256+
]
257+
},
258+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
259+
}
260+
]
261+
}
262+
}
263+
}

0 commit comments

Comments
 (0)