Skip to content

fix(elasticloadbalancingv2): allow logging in env-agnostic stacks - #38231

Open
Dricmoy wants to merge 4 commits into
aws:mainfrom
Dricmoy:fix/elbv2-env-agnostic-access-logs-27432
Open

fix(elasticloadbalancingv2): allow logging in env-agnostic stacks#38231
Dricmoy wants to merge 4 commits into
aws:mainfrom
Dricmoy:fix/elbv2-env-agnostic-access-logs-27432

Conversation

@Dricmoy

@Dricmoy Dricmoy commented Jul 1, 2026

Copy link
Copy Markdown

Issue # (if applicable)

Closes #27432.

Reason for this change

ELBv2 access logging currently requires a resolved stack region because CDK looks up a legacy, region-specific Elastic Load Balancing account principal before synthesizing the bucket policy. That prevents access logging from being used in environment-agnostic stacks even though the current Elastic Load Balancing documentation recommends the service principal logdelivery.elasticloadbalancing.amazonaws.com.

Description of changes

  • Uses the Elastic Load Balancing log delivery service principal when the stack region is unresolved.
  • Preserves the existing region-specific account principal behavior for concrete regions where CDK has legacy ELBv2 account metadata.
  • Removes stale documentation that said access logging and connection logging cannot be used in environment-agnostic stacks.
  • Adds ALB and NLB coverage for environment-agnostic access logging, plus ALB connection logging coverage.

Describe any new or updated permissions being added

For environment-agnostic ELBv2 logging bucket policies, CDK now synthesizes an s3:PutObject grant to the logdelivery.elasticloadbalancing.amazonaws.com service principal instead of throwing during synthesis. Concrete-region behavior is unchanged.

Description of how you validated changes

  • env PATH=/opt/homebrew/opt/node@24/bin:$PATH yarn test --coverage=false --runTestsByPath aws-elasticloadbalancingv2/test/alb/load-balancer.test.ts aws-elasticloadbalancingv2/test/nlb/load-balancer.test.ts
  • env PATH=/opt/homebrew/opt/node@24/bin:$PATH yarn build --skip-lint

Checklist

@github-actions github-actions Bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label Jul 1, 2026
@github-actions github-actions Bot added effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2 labels Jul 1, 2026
@aws-cdk-automation
aws-cdk-automation requested a review from a team July 1, 2026 19:42

@aws-cdk-automation aws-cdk-automation left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(This review is outdated)

@aws-cdk-automation aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Jul 1, 2026
@aws-cdk-automation
aws-cdk-automation dismissed their stale review July 2, 2026 02:29

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@Dricmoy
Dricmoy force-pushed the fix/elbv2-env-agnostic-access-logs-27432 branch from cdde9c2 to 36bc409 Compare July 2, 2026 05:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2 pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

elasticloadbalancing: allow logAccessLogs on environment agnostic stack

3 participants