feat(elasticloadbalancingv2): health check logs for ALB by ren-yamanashi · Pull Request #36227 · aws/aws-cdk

ren-yamanashi · 2025-11-27T14:31:34Z

This PR is similar to #30599

Reason for this change

ALB can output health check logs as well as access logs to the S3 bucket, but this is not yet supported by L2 Construct.
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-health-check-logging.html

Description of changes

Since health check logs are not supported by NLB, but only by ALB, the logHealthCheckLogs method is added to the ApplicationLoadBalancer instead of the BaseLoadBalancer.

The needed BucketPolicy is described in the documentation only as follows.

{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "logdelivery.elasticloadbalancing.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*"
    }
  ]
}

Description of how you validated changes

add unit tests and integ tests.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

ren-yamanashi · 2025-11-28T14:36:13Z

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts

+    bucket.addToResourcePolicy(
+      new PolicyStatement({
+        actions: ['s3:PutObject'],
+        principals: [this.resourcePolicyPrincipal()],


This code is followed logConnectionLogs method.

see: https://github.com/aws/aws-cdk/blob/v2.230.0/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts#L368

The key point when use resourcePolicyPrincipal method, this public method (logHealthCheckLogs) needs specified region on the stack.

But, based on the documents I think we can choice don't use resourcePolicyPrincipal method like here code.
(see: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-health-check-logging.html)

principals: [new iam.ServicePrincipal('logdelivery.elasticloadbalancing.amazonaws.com')],

And when we choice it, not needs specified region on the stack.

Q. Which I choice? Use resourcePolicyPrincipal method? or not use?

Current situation is not same when implementation logConnectionLogs method, so I want advice for you.

@badmintoncryer

What could you think about this?

Personally, I’d prefer to implement it using the ServicePrincipal method, but I think it’s better to align with the existing implementation…

For now, let’s keep the current implementation as is, and could you discuss this with the maintainers again?

Okay. I follow you.

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

…feat/alb-healthcheck-log

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts

badmintoncryer

Thank you for your contribution! I've added some comments.

...cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.log.enable-acl.ts

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts

…feat/alb-healthcheck-log

github-actions · 2025-12-06T03:39:25Z

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results	104 ran	93 passed	0 skipped	11 failed

Test	Result
Security Guardian Results
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.log.enable-acl.js.snapshot/aws-cdk-elbv2-integ-enable-acl.template.json
ec2-no-open-security-groups.guard	❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard	❌ failure
iam-no-wildcard-actions-inline.guard	❌ failure
s3-encryption-enabled.guard	❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.log.imported-bucket.js.snapshot/aws-cdk-alb-log-imported-bucket-integ.template.json
ec2-no-open-security-groups.guard	❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard	❌ failure
s3-encryption-enabled.guard	❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.log.js.snapshot/aws-cdk-elbv2-integ.template.json
ec2-no-open-security-groups.guard	❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard	❌ failure
iam-no-wildcard-actions-inline.guard	❌ failure
s3-encryption-enabled.guard	❌ failure

View Security Guardian Results

github-actions · 2025-12-06T03:39:26Z

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results with resolved templates	104 ran	93 passed	0 skipped	11 failed

Test	Result
Security Guardian Results with resolved templates
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.log.enable-acl.js.snapshot/aws-cdk-elbv2-integ-enable-acl.template.json
ec2-no-open-security-groups.guard	❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard	❌ failure
iam-no-wildcard-actions-inline.guard	❌ failure
s3-encryption-enabled.guard	❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.log.imported-bucket.js.snapshot/aws-cdk-alb-log-imported-bucket-integ.template.json
ec2-no-open-security-groups.guard	❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard	❌ failure
s3-encryption-enabled.guard	❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.log.js.snapshot/aws-cdk-elbv2-integ.template.json
ec2-no-open-security-groups.guard	❌ failure
guardhooks-no-root-principals-except-kms-secrets.guard	❌ failure
iam-no-wildcard-actions-inline.guard	❌ failure
s3-encryption-enabled.guard	❌ failure

View Security Guardian Results with resolved templates

ren-yamanashi

@badmintoncryer

Thanks review! I fixed and reply your comments.

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts

ren-yamanashi · 2025-12-06T05:20:52Z

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts

+    bucket.addToResourcePolicy(
+      new PolicyStatement({
+        actions: ['s3:PutObject'],
+        principals: [this.resourcePolicyPrincipal()],


@badmintoncryer

What could you think about this?

...cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.log.enable-acl.ts

badmintoncryer

Thanks! I've replied your comments.

ren-yamanashi · 2025-12-06T09:48:50Z

@badmintoncryer

I fixed! Please confirm

…feat/alb-healthcheck-log

badmintoncryer · 2025-12-07T07:18:49Z

Thank you for your great work!

feat(elasticloadbalancingv2): healthCheck logs for ALB

b2ff5fb

aws-cdk-automation requested a review from a team November 27, 2025 14:31

github-actions bot added p2 valued-contributor [Pilot] contributed between 6-12 PRs to the CDK labels Nov 27, 2025

ren-yamanashi changed the title ~~feat(elasticloadbalancingv2): healthCheck logs for ALB~~ feat(elasticloadbalancingv2): health check logs for ALB Nov 27, 2025

aws-cdk-automation previously requested changes Nov 27, 2025

View reviewed changes

pahud mentioned this pull request Nov 27, 2025

Failed CodeBuild CI - 33 PR(s) pahud/aws-cdk#17

Open

ren_yamanashi added 3 commits November 28, 2025 22:47

test: add unit test

07c7645

test: add comment

412c6e7

test: update

03271c1

ren-yamanashi commented Nov 28, 2025

View reviewed changes

chore: update jsdoc

f0bccf7

ren-yamanashi commented Nov 28, 2025

View reviewed changes

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts Show resolved Hide resolved

ren_yamanashi and others added 4 commits November 29, 2025 01:21

docs: update README.md

8d35eaf

chore: rm changes

747a861

chore: rm changes

c778084

test: add integ test

756938f

ren-yamanashi added 2 commits November 29, 2025 11:50

test: add integ test

f95848b

Merge branch 'main' of https://github.com/ren-yamanashi/aws-cdk into …

6498fa7

…feat/alb-healthcheck-log

ren-yamanashi commented Nov 29, 2025

View reviewed changes

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts Show resolved Hide resolved

test: add integ test

ed1f307

ren-yamanashi marked this pull request as ready for review November 29, 2025 05:15

test: update integ test assets

645eafc

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 29, 2025

github-actions bot mentioned this pull request Dec 1, 2025

Monthly PR metrics report #36251

Open

badmintoncryer suggested changes Dec 2, 2025

View reviewed changes

aws-cdk-automation removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Dec 2, 2025

Merge branch 'main' of https://github.com/ren-yamanashi/aws-cdk into …

9055a51

…feat/alb-healthcheck-log

update integ test

db0fccd

ren-yamanashi commented Dec 6, 2025

View reviewed changes

badmintoncryer reviewed Dec 6, 2025

View reviewed changes

ren-yamanashi force-pushed the feat/alb-healthcheck-log branch from 062cbf1 to db0fccd Compare December 6, 2025 09:16

update error msg

961b907

ren_yamanashi added 2 commits December 7, 2025 10:57

update error msg

974e516

Merge branch 'main' of https://github.com/ren-yamanashi/aws-cdk into …

364abd3

…feat/alb-healthcheck-log

badmintoncryer approved these changes Dec 7, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Dec 7, 2025

Conversation

ren-yamanashi commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reason for this change

Description of changes

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ren-yamanashi Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ren-yamanashi Dec 6, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Dec 6, 2025

Choose a reason for hiding this comment

Uh oh!

ren-yamanashi Dec 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

badmintoncryer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Dec 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ren-yamanashi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ren-yamanashi Dec 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

badmintoncryer left a comment

Choose a reason for hiding this comment

Uh oh!

ren-yamanashi commented Dec 6, 2025

Uh oh!

badmintoncryer commented Dec 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ren-yamanashi commented Nov 27, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

ren-yamanashi Nov 28, 2025 •

edited

Loading

github-actions bot commented Dec 6, 2025 •

edited

Loading

github-actions bot commented Dec 6, 2025 •

edited

Loading