fix: authorize channel-project vended log delivery - #47
Merged
Conversation
Add the AWS-documented CloudWatch Logs V2 delivery permissions and the CloudFront AllowVendedLogDeliveryForResource authorization to the channel-project site-infrastructure role. The consumer apply that created distribution E3TJ32HSW2SEZ9 failed only at PutDeliverySource with AccessDeniedException for cloudfront:AllowVendedLogDeliveryForResource; the permission set follows the documented S3-destination vended-delivery policy, scoped to this account's delivery objects and distributions.
Contributor
OpenTofu TestOpenTofu test passed. View run output |
Contributor
OpenTofu PlanOpenTofu plan passed. View run outputOpenTofu will perform the following actions:
# aws_iam_role_policy.github_actions_channel_project_site_infrastructure will be updated in-place
~ resource "aws_iam_role_policy" "github_actions_channel_project_site_infrastructure" {
id = "github-actions-channel-project-site-infrastructure:channel-project-site-infrastructure"
name = "channel-project-site-infrastructure"
~ policy = jsonencode(
~ {
~ Statement = [
# (7 unchanged elements hidden)
{
Action = [
"cloudfront:GetCachePolicy",
"cloudfront:GetResponseHeadersPolicy",
"cloudfront:ListCachePolicies",
"cloudfront:ListResponseHeadersPolicies",
]
Effect = "Allow"
Resource = "*"
Sid = "ReadManagedCloudFrontPolicies"
},
+ {
+ Action = [
+ "logs:CreateDelivery",
+ "logs:DeleteDelivery",
+ "logs:DeleteDeliveryDestination",
+ "logs:DeleteDeliveryDestinationPolicy",
+ "logs:DeleteDeliverySource",
+ "logs:GetDelivery",
+ "logs:GetDeliveryDestination",
+ "logs:GetDeliveryDestinationPolicy",
+ "logs:GetDeliverySource",
+ "logs:PutDeliveryDestination",
+ "logs:PutDeliveryDestinationPolicy",
+ "logs:PutDeliverySource",
+ "logs:UpdateDeliveryConfiguration",
]
+ Effect = "Allow"
+ Resource = [
+ "arn:aws:logs:us-east-1:332355796717:delivery:*",
+ "arn:aws:logs:us-east-1:332355796717:delivery-source:*",
+ "arn:aws:logs:us-east-1:332355796717:delivery-destination:*",
]
+ Sid = "ManageVendedLogDeliveries"
},
+ {
+ Action = [
+ "logs:DescribeConfigurationTemplates",
+ "logs:DescribeDeliveries",
+ "logs:DescribeDeliveryDestinations",
+ "logs:DescribeDeliverySources",
]
+ Effect = "Allow"
+ Resource = "*"
+ Sid = "DescribeVendedLogDeliveries"
},
+ {
+ Action = [
+ "cloudfront:AllowVendedLogDeliveryForResource",
]
+ Effect = "Allow"
+ Resource = [
+ "arn:aws:cloudfront::332355796717:distribution/*",
]
+ Sid = "AuthorizeSiteVendedLogDelivery"
},
]
# (1 unchanged attribute hidden)
}
)
# (1 unchanged attribute hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.
OpenTofu will perform the following actions:
# aws_iam_role_policy.github_actions_channel_project_site_infrastructure will be updated in-place
~ resource "aws_iam_role_policy" "github_actions_channel_project_site_infrastructure" {
id = "github-actions-channel-project-site-infrastructure:channel-project-site-infrastructure"
name = "channel-project-site-infrastructure"
~ policy = jsonencode(
~ {
~ Statement = [
# (7 unchanged elements hidden)
{
Action = [
"cloudfront:GetCachePolicy",
"cloudfront:GetResponseHeadersPolicy",
"cloudfront:ListCachePolicies",
"cloudfront:ListResponseHeadersPolicies",
]
Effect = "Allow"
Resource = "*"
Sid = "ReadManagedCloudFrontPolicies"
},
+ {
+ Action = [
+ "logs:CreateDelivery",
+ "logs:DeleteDelivery",
+ "logs:DeleteDeliveryDestination",
+ "logs:DeleteDeliveryDestinationPolicy",
+ "logs:DeleteDeliverySource",
+ "logs:GetDelivery",
+ "logs:GetDeliveryDestination",
+ "logs:GetDeliveryDestinationPolicy",
+ "logs:GetDeliverySource",
+ "logs:PutDeliveryDestination",
+ "logs:PutDeliveryDestinationPolicy",
+ "logs:PutDeliverySource",
+ "logs:UpdateDeliveryConfiguration",
]
+ Effect = "Allow"
+ Resource = [
+ "arn:aws:logs:us-east-1:332355796717:delivery:*",
+ "arn:aws:logs:us-east-1:332355796717:delivery-source:*",
+ "arn:aws:logs:us-east-1:332355796717:delivery-destination:*",
]
+ Sid = "ManageVendedLogDeliveries"
},
+ {
+ Action = [
+ "logs:DescribeConfigurationTemplates",
+ "logs:DescribeDeliveries",
+ "logs:DescribeDeliveryDestinations",
+ "logs:DescribeDeliverySources",
]
+ Effect = "Allow"
+ Resource = "*"
+ Sid = "DescribeVendedLogDeliveries"
},
+ {
+ Action = [
+ "cloudfront:AllowVendedLogDeliveryForResource",
]
+ Effect = "Allow"
+ Resource = [
+ "arn:aws:cloudfront::332355796717:distribution/*",
]
+ Sid = "AuthorizeSiteVendedLogDelivery"
},
]
# (1 unchanged attribute hidden)
}
)
# (1 unchanged attribute hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cloudfront:AllowVendedLogDeliveryForResourceauthorization to thegithub-actions-channel-project-site-infrastructurerole's inline policy.ManageVendedLogDeliveries(read/write delivery actions scoped to this account'sdelivery,delivery-source, anddelivery-destinationARNs inus-east-1),DescribeVendedLogDeliveries(describe-only actions,Resource: "*"as documented), andAuthorizeSiteVendedLogDelivery(the CloudFront service-specific action scoped to this account's distributions).Fixes # N/A — evidence-driven follow-up to #44–#46 for the channel-project CloudFront standard logging v2 delivery; no tracking issue.
Type of change
Validation
No local OpenTofu, state, or provider operation was run or claimed. Evidence: the channel-project main apply (run 33914120213) created the distribution
E3TJ32HSW2SEZ9, the origin bucket policy, and thePutDeliveryDestinationobject, then failed solely atPutDeliverySourcewithAccessDeniedExceptionforcloudfront:AllowVendedLogDeliveryForResourceon the distribution ARN. The added permission set follows the AWS-documented policy for V2 vended log delivery to Amazon S3 (CloudWatch Logs vended logs permissions V2 — S3 destinations and service-specific permissions), not mechanically inferred API names.Impact and rollout
tfroot-awsremains the producer of this role; the consumer configuration inchannel-project/tofu/aws/is unchanged. After merge, the main apply updates only this role's inline policy — no other resource changes are expected in this root. The follow-up is a separately approved rerun of the failed consumer apply to create the two remaining log-delivery resources; nothing in this PR touches registrar, DNS, buckets, distribution configuration, or publication paths.Safety and secrets
AI agent materially produced this change; reviewers should confirm the permission list against the cited AWS documentation and the ARN scoping before authorizing the merge.