After utilizing the AWS console to create a bucket for access logging via the load balancer edit attributes screen, I am now in the process of transforming this action into CDK code using TypeScript. This allows me to automate the creation of new S3 buckets for access logging in environments that do not allow console usage. The specific policy I need to translate into TypeScript CDK code is as follows:
"Statement": [
{
"Effect":Allow",
"Principal": {
"AWS": "arn:--ELB-arnstuff--:root"
},
"Action": "s3:PutObject",
"Resource": "arn:--S3-Bucket-arnstuff--/AWSLogs/123456789/*"
}
]
So far, I have made progress with the CDK code up to this point:
bucket.addToResourcePolicy(
new cdk.aws_iam.PolicyStatement({
effect: awsIam.Effect.ALLOW,
principals: //'**This is part I haven't figured out**',
actions: ['s3:PutObject'],
resources: ['${bucket.bucketArn}/*']
})
);
Although I am open to hardcoding the solution in the CDK at this stage, any assistance in figuring out the remaining piece would be greatly appreciated. Thank you!