fix(ec2): Cannot deploy VPC flow log with other resources that requires bucket policies

[tmokmss]

Closes #18985.

The problem is described on the issue. In short, when we enable VPC Flow log, it tries to create a bucket policy for the target S3 bucket. That's why a deployment fails if there is a bucket policy defined in a CFn template and the policy is created AFTER a flow log is enabled, which cannot replace the existing policy created by the flow log.

To avoid the error, this PR adds explicit dependencies for a VPC flow log resource:

• dependency 1: Flow log must be created after a corresponding bucket policy is created by CFn
• dependency 2: Flow log must be deleted before a corresponding autoDeleteObjects custom resource removed (i.e. deleting all the objects in the bucket).

Dependency 2 is actually not related to the original issue, but I'd like to add this because I saw the error relating this on the integration tests.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[comcalvi]

Thanks for the PR, this is great!

Could you add the stack you included as reproduction steps as a new stack in packages/@aws-cdk/aws-ec2/test/integ.vpc-flow-logs.ts?

It's this code:

import * as cdk from 'aws-cdk-lib';
import { RemovalPolicy, Stack } from 'aws-cdk-lib';
import { FlowLogDestination, Vpc } from 'aws-cdk-lib/aws-ec2';
import { Bucket } from 'aws-cdk-lib/aws-s3';

const stack = new Stack(new cdk.App(), "Stack");

const vpc = new Vpc(stack, 'Vpc', {
  natGateways: 1,
});

const logBucket = new Bucket(stack, 'LogBucket', {
  autoDeleteObjects: true,
  removalPolicy: RemovalPolicy.DESTROY,
});

vpc.addFlowLog('FlowLogS3', {
  destination: FlowLogDestination.toS3(logBucket, 'vpcFlowLog'),
});

Pull request has been modified.

[tmokmss]

Hi @comcalvi, thanks for the review! I added the integ test.

I also added { natGateways: 1 } for each VPCs because otherwise 6 EIPs are required to run the test, which exceeds he default quota for #of EIPs (5), and thus cannot be deployed easily.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 7dfac61
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).