Describe the feature
#21113 introduced removalPolicy for LogRetention custom resource to allow us to delete log groups inside a stack. However, because we don't have a corresponding property in Lambda Function construct, it seems we still cannot remove a log group for a Lambda function automatically when we delete a stack. (Sorry if I'm missing something)
Use Case
Automatically remove log groups for lambda functions inside a stack when we delete it.
Proposed Solution
1st idea:
Add a property e.g. logRetentionRemovalPolicy? here:
|
readonly logRetentionRole?: iam.IRole; |
The property will be only valid when logRetention is set. There might be a better API for this but at least it should work and won't introduce any breaking change :(
2nd Idea (which might have better DX):
Add a property like autoDeleteLog?: boolean.
If users specify this, we internally create a logRetention with length of logRetention property or RetentionDays.INFINITY if not specified, and set logRetention.RemovalPolicy to destroy. By this we only have to set autoDeleteLog: true when we just want to delete a log groups on removal of the function.
Other Information
An aspect like below will not work either:
class SetLogGroupRemovalPolicy implements IAspect {
public visit(node: CfnResource): void {
if (node.cfnResourceType == 'Custom::LogRetention') {
node.addOverride('Properties.RemovalPolicy', 'destroy');
}
}
}because we still need to configure IAM policy to allow the lambda to delete the log group, which is set here.
|
if (props.removalPolicy === cdk.RemovalPolicy.DESTROY) { |
|
role.addToPrincipalPolicy(new iam.PolicyStatement({ |
|
actions: ['logs:DeleteLogGroup'], |
|
//Only allow deleting the specific log group. |
|
resources: [cdk.Stack.of(this).formatArn({ |
|
service: 'logs', |
|
resource: 'log-group', |
|
resourceName: `${props.logGroupName}:*`, |
|
arnFormat: ArnFormat.COLON_RESOURCE_NAME, |
|
})], |
|
})); |
|
role.addToPrincipalPolicy(new iam.PolicyStatement({ |
|
actions: ['logs:DeleteLogStream'], |
|
//Only allow deleting the specific log group. |
|
resources: [cdk.Stack.of(this).formatArn({ |
|
service: 'logs', |
|
resource: `log-group:${props.logGroupName}:log-stream`, |
|
resourceName: '*', |
|
arnFormat: ArnFormat.COLON_RESOURCE_NAME, |
|
})], |
|
})); |
|
} |
It results in the bellow error:
10:22:50 PM | DELETE_FAILED | Custom::LogRetention | HandlerLogRetention34184093
Received response status [FAILED] from custom resource. Message returned: User: arn:aws:sts::1:assumed-role/Stack-LogRetentionaae0aa3c
5b4d4f87b02d85b2-1XVR8ES6GII3X/Stack-LogRetentionaae0aa3c5b4d4f87b02d85b2-QJvljA9zM3Gp is not authorized to perform: logs:DeleteLogGroup on resou
rce: arn:aws:logs:ap-northeast-1:123456789012:log-group:/aws/lambda/Stack-Handler886CB40B-WSAN0fvgsbiN:log-stream: because no identity-based poli
cy allows the logs:DeleteLogGroup action (RequestId: 70428621-b81e-4e56-a8f3-8c2a788b9e13)
Acknowledgements
CDK version used
2.39.0
Environment details (OS name and version, etc.)
macOS
Describe the feature
#21113 introduced
removalPolicyforLogRetentioncustom resource to allow us to delete log groups inside a stack. However, because we don't have a corresponding property in Lambda Function construct, it seems we still cannot remove a log group for a Lambda function automatically when we delete a stack. (Sorry if I'm missing something)Use Case
Automatically remove log groups for lambda functions inside a stack when we delete it.
Proposed Solution
1st idea:
Add a property e.g.
logRetentionRemovalPolicy?here:aws-cdk/packages/@aws-cdk/aws-lambda/lib/function.ts
Line 294 in 478b996
The property will be only valid when
logRetentionis set. There might be a better API for this but at least it should work and won't introduce any breaking change :(2nd Idea (which might have better DX):
Add a property like
autoDeleteLog?: boolean.If users specify this, we internally create a logRetention with length of
logRetentionproperty orRetentionDays.INFINITYif not specified, and setlogRetention.RemovalPolicytodestroy. By this we only have to setautoDeleteLog: truewhen we just want to delete a log groups on removal of the function.Other Information
An aspect like below will not work either:
because we still need to configure IAM policy to allow the lambda to delete the log group, which is set here.
aws-cdk/packages/@aws-cdk/aws-logs/lib/log-retention.ts
Lines 162 to 183 in 478b996
It results in the bellow error:
Acknowledgements
CDK version used
2.39.0
Environment details (OS name and version, etc.)
macOS