chore(mixins-preview): update Vended Logs to use Facades and Traits and add `actions` methods to `BucketGrants` by ShadowCat567 · Pull Request #37239 · aws/aws-cdk

ShadowCat567 · 2026-03-12T19:15:36Z

Reason for this change

Vended Logs was previously not using the Traits and Facades that have been introduced with the GA of Mixins.

BucketGrants is a handwritten Grants class and did not benefit from the update a lot of the other Grants classes received which gave them access to the .actions() method.

Description of changes

Note: most of these changes involve refreshing the e2e test files mostly because policy names have changed and some implementation details are a bit different because of grants, the permissions themselves have not changed

This changes the implementation but not the behavior of Vended Logs to use the Facades and Traits.
BucketGrants now has 2 methods which operate like the .actions() method in other Grants classes. BucketGrants gets 2 methods while most other classes only get one because BucketGrants has a somewhat unique scenario where it always receives some kind of object arn to be able to apply permissions to accessing objects in a bucket, but does not always receive a bucket arn which controls what can be done to the bucket itself. We split these 2 use cases into 2 different grant methods.

Describe any new or updated permissions being added

Corrects Vended Logs S3 Bucket permissions to not grant to log stream, this is inline with Vended Logs documentation: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-S3.html

Description of how you validated changes

Updated unit and integration tests in vended logs and added new unit tests to for BucketGrants

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

github-actions · 2026-03-12T19:18:11Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	120 ran	120 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2026-03-12T19:18:14Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	120 ran	120 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

otaviomacedo · 2026-03-13T13:24:01Z

@@ -141,6 +141,19 @@ export class BucketGrants {
    return this.grant(identity, perms.BUCKET_PUT_ACL_ACTIONS, [], this.arnForObjects(objectsKeyPattern));


Now you can update the other methods to use the new actions().

otaviomacedo · 2026-03-13T13:25:17Z

+   * @param actions The actions to grant (e.g. 's3:GetObject').
+   */
+  public actions(identity: IGrantable, objectsKeyPattern: string = '*', ...actions: string[]) {
+    return this.grant(identity, actions, [],


Maybe the key actions should also become a parameter, instead of being hard-coded as an empty array.

I was thinking about having actions be able to take both Key and Bucket actions (and we sort them out inside the actions method) since you can't have 2 variadic parameters

otaviomacedo · 2026-03-16T10:03:15Z

         "Arn"
        ]
       },
-       ":log-stream:*\"}],\"Version\":\"2012-10-17\"}"


Is this change correct? It's hard to tell from this diff, but it seems that we are removing the log streams permission and just granting permission to the log group.

yeah, I think this needs alteration...need to look at the docs again and see if I can set this up with bucketGrants

looked through my test stacks and took a second look over the documentation, granting log stream permissions was incorrect to begin with, these permissions are the correct ones

otaviomacedo · 2026-03-16T10:06:57Z

+   * @param actions The S3 and/or KMS actions to grant.
+   */
+  public actionsOnObjectKeys(identity: IGrantable, objectsKeyPattern: string = '*', ...actions: string[]) {
+    const keyActions: string[] = [];


(minor) we can remove the duplication between the two new methods by delegating to a new private one.

otaviomacedo · 2026-03-16T10:07:55Z

    // when
    bucket.grantDelete(deleter);
-
+    console.log(JSON.stringify(Template.fromStack(stack), null, 2));


Left behind unintentionally?

not intentional, was using this for debugging

mergify · 2026-03-16T14:40:27Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-03-16T14:40:45Z

mergify · 2026-03-16T15:10:24Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2026-03-16T15:10:44Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

aws-amplify-bot added 2 commits March 12, 2026 13:55

vended logs uses facades and traits

4c8ef14

Merge branch 'main' into vended-logs/use-refl

3950ba4

ShadowCat567 temporarily deployed to automation March 12, 2026 19:15 — with GitHub Actions Inactive

github-actions Bot added p2 admired-contributor [Pilot] contributed between 13-24 PRs to the CDK labels Mar 12, 2026

aws-cdk-automation requested a review from a team March 12, 2026 19:15

ShadowCat567 temporarily deployed to automation March 12, 2026 19:15 — with GitHub Actions Inactive

mergify Bot added the contribution/core This is a PR that came from AWS. label Mar 12, 2026

mergify Bot temporarily deployed to automation March 12, 2026 19:16 Inactive

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Mar 12, 2026

aws-cdk-automation temporarily deployed to automation March 12, 2026 19:37 — with GitHub Actions Inactive

aws-cdk-automation temporarily deployed to automation March 12, 2026 19:38 — with GitHub Actions Inactive

pahud mentioned this pull request Mar 12, 2026

Failed CodeBuild CI - 14 PR(s) pahud/aws-cdk#17

Open

bucketGrants

7e5451b

ShadowCat567 temporarily deployed to automation March 12, 2026 22:01 — with GitHub Actions Inactive

actually add bucketgrants

727364b

ShadowCat567 temporarily deployed to automation March 12, 2026 22:02 — with GitHub Actions Inactive

otaviomacedo reviewed Mar 13, 2026

View reviewed changes

update buckteGrants actions

d76f639

ShadowCat567 temporarily deployed to automation March 13, 2026 18:30 — with GitHub Actions Inactive

ShadowCat567 temporarily deployed to automation March 13, 2026 18:31 — with GitHub Actions Inactive

ShadowCat567 temporarily deployed to automation March 13, 2026 18:37 — with GitHub Actions Inactive

ShadowCat567 changed the title ~~chore(mixins-preview): update Vended Logs to use Facades and Traits~~ chore(mixins-preview): update Vended Logs to use Facades and Traits and add actions methods to BucketGrants Mar 13, 2026

ShadowCat567 temporarily deployed to automation March 13, 2026 19:03 — with GitHub Actions Inactive

aws-cdk-automation removed the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Mar 13, 2026

aws-cdk-automation temporarily deployed to automation March 13, 2026 19:36 — with GitHub Actions Inactive

ShadowCat567 marked this pull request as ready for review March 13, 2026 19:45

ShadowCat567 temporarily deployed to automation March 13, 2026 19:45 — with GitHub Actions Inactive

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 13, 2026

aws-cdk-automation temporarily deployed to automation March 13, 2026 19:47 — with GitHub Actions Inactive

ShadowCat567 temporarily deployed to automation March 13, 2026 19:47 — with GitHub Actions Inactive

otaviomacedo reviewed Mar 16, 2026

View reviewed changes

ShadowCat567 temporarily deployed to automation March 16, 2026 13:29 — with GitHub Actions Inactive

pr feedback

2915954

ShadowCat567 temporarily deployed to automation March 16, 2026 13:57 — with GitHub Actions Inactive

ShadowCat567 temporarily deployed to automation March 16, 2026 13:58 — with GitHub Actions Inactive

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Mar 16, 2026

aws-cdk-automation temporarily deployed to automation March 16, 2026 14:08 — with GitHub Actions Inactive

otaviomacedo approved these changes Mar 16, 2026

View reviewed changes

Merge branch 'main' into vended-logs/use-refl

c6a3e31

mergify Bot temporarily deployed to automation March 16, 2026 14:40 Inactive

mergify Bot merged commit 4f0d32e into main Mar 16, 2026
23 of 24 checks passed

mergify Bot deleted the vended-logs/use-refl branch March 16, 2026 15:10

github-actions Bot locked as resolved and limited conversation to collaborators Mar 16, 2026

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 16, 2026

aws-cdk-automation temporarily deployed to automation March 16, 2026 15:12 — with GitHub Actions Inactive

		@@ -141,6 +141,19 @@ export class BucketGrants {
		return this.grant(identity, perms.BUCKET_PUT_ACL_ACTIONS, [], this.arnForObjects(objectsKeyPattern));

Conversation

ShadowCat567 commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

github-actions Bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

otaviomacedo Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

otaviomacedo Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ShadowCat567 Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

otaviomacedo Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

ShadowCat567 Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

ShadowCat567 Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

otaviomacedo Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

otaviomacedo Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

ShadowCat567 Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mergify Bot commented Mar 16, 2026

Uh oh!

mergify Bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

mergify Bot commented Mar 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ShadowCat567 commented Mar 12, 2026 •

edited

Loading

github-actions Bot commented Mar 12, 2026 •

edited

Loading

github-actions Bot commented Mar 12, 2026 •

edited

Loading

otaviomacedo Mar 13, 2026 •

edited

Loading

ShadowCat567 Mar 16, 2026 •

edited

Loading

mergify Bot commented Mar 16, 2026 •

edited

Loading