Interface IAccessLogBucketConfig

Custom policy overrides configuration.

Remarks

Use this configuration to provide JSON string policy file for bucket resource policy. Bucket resource policy will be over written by content of this file, so when using these option policy files must contain complete policy document. When customPolicyOverrides.s3Policy defined importedBucket.applyAcceleratorManagedBucketPolicy can not be set to true also s3ResourcePolicyAttachments property can not be defined.

Use the following configuration to apply custom bucket resource policy overrides through policy JSON file.

customPolicyOverrides:
  s3Policy: path/to/policy.json
Copy

Default

undefined
Copy

To control target environments (AWS Account and Region) for the given accessLogBucket setting, you may optionally specify deployment targets. Leaving deploymentTargets undefined will apply useCMK setting to all accounts and enabled regions.

Flag indicating S3 access logging bucket is enable by solution.

Remarks

When this property is undefined solution will create S3 access log bucket. You can use deploymentTargets to control target accounts and regions for the given accessLogBucket configuration. In the solution, this property will be ignored and S3 Access log buckets will be created for the installer bucket, pipeline bucket, solution deployed CentralLogs bucket, and solution deployed Assets bucket, since these buckets always have server access logging enabled.

Imported bucket configuration.

Remarks

Use this configuration to import an existing AccessLogs bucket and manage its resource policy through the solution.

Important: Per AWS S3 documentation, both source and destination buckets must be in the same AWS Region and owned by the same account. Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html

The bucket must be pre-created in each target account and region using a repeatable naming pattern so the LZA can locate the bucket across accounts and regions. Include the ${ACCOUNT_ID} and ${REGION} parameters in your naming pattern, which will be automatically populated by the LZA to ensure uniqueness.

For more information on solution-specific variables, see: https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/working-with-solution-specific-variables.html

Example

importedBucket:
  name: existing-access-log-bucket-${ACCOUNT_ID}-${REGION}
  applyAcceleratorManagedBucketPolicy: true
Copy

Default

undefined
Copy

Declaration of (S3 Bucket) Lifecycle rules.

JSON policy files.

Remarks

Policy statements from these files will be added to the bucket resource policy. This property can not be used when customPolicyOverrides.s3Policy property has value.

Note: When Block Public Access is enabled for S3 on the AWS account, you can't specify a policy that would make the S3 Bucket public.