[AWS CDK] CloudFrontの標準ログV2をL1 Constructで設定してみたかった

    // CloudFront Standard Log V2
    if (props.enableLogAnalytics.includes("cloudFrontStandardLogV2")) {
      // Remove CloudFront Standard Log Legacy
      const cfnDistribution = this.distribution.node
        .defaultChild as cdk.aws_cloudfront.CfnDistribution;
      cfnDistribution.addPropertyDeletionOverride("DistributionConfig.Logging");

      const logPrefix = this.getStandardLogV2Prefix(props.logFilePrefix);

      props.cloudFrontAccessLogBucketConstruct.bucket.addToResourcePolicy(
        new cdk.aws_iam.PolicyStatement({
          actions: ["s3:PutObject"],
          effect: cdk.aws_iam.Effect.ALLOW,
          principals: [
            new cdk.aws_iam.ServicePrincipal("delivery.logs.amazonaws.com"),
          ],
          resources: [
            `${props.cloudFrontAccessLogBucketConstruct.bucket.bucketArn}/${logPrefix.awsLogObjectPrefix}*`,
          ],
          conditions: {
            StringEquals: {
              "s3:x-amz-acl": "bucket-owner-full-control",
              "aws:SourceAccount": cdk.Stack.of(this).account,
            },
            ArnLike: {
              "aws:SourceArn": `arn:aws:logs:${cdk.Stack.of(this).region}:${
                cdk.Stack.of(this).account
              }:delivery-source:cf-${this.distribution.distributionId}`,
            },
          },
        })
      );

      const cloudFrontStandardLogDeliverySourceName = `cf-${this.distribution.distributionId}`;
      const cloudFrontStandardLogDeliveryDestinationName = `cf-${this.distribution.distributionId}-s3`;

      const cloudFrontStandardLogDeliverySource =
        new cdk.aws_logs.CfnDeliverySource(
          this,
          "CloudFrontStandardLogDeliverySource",
          {
            name: cloudFrontStandardLogDeliverySourceName,
            resourceArn: this.distribution.distributionArn,
            logType: "ACCESS_LOGS",
          }
        );

      const cloudFrontStandardLogDeliveryDestination =
        new cdk.aws_logs.CfnDeliveryDestination(
          this,
          "CloudFrontStandardLogDeliveryDestination",
          {
            name: cloudFrontStandardLogDeliveryDestinationName,
            outputFormat: "parquet",
            destinationResourceArn:
              props.cloudFrontAccessLogBucketConstruct.bucket.bucketArn,
          }
        );

      new cdk.custom_resources.AwsCustomResource(
        this,
        "CloudFrontStandardLogDelivery",
        {
          logRetention: cdk.aws_logs.RetentionDays.ONE_WEEK,
          serviceTimeout: cdk.Duration.seconds(180),
          timeout: cdk.Duration.seconds(120),
          installLatestAwsSdk: true,
          onCreate: {
            action: "createDelivery",
            parameters: {
              deliverySourceName: cloudFrontStandardLogDeliverySource.name,
              deliveryDestinationArn:
                cloudFrontStandardLogDeliveryDestination.attrArn,
              s3EnableHiveCompatiblePath: false,
              s3DeliveryConfiguration: {
                enableHiveCompatiblePath: false,
                suffixPath: logPrefix.logPrefix.split(
                  logPrefix.awsLogObjectPrefix
                )[1],
              },
            },
            physicalResourceId:
              cdk.custom_resources.PhysicalResourceId.fromResponse(
                "delivery.id"
              ),
            service: "CloudWatchLogs",
          },
          onUpdate: {
            action: "updateDeliveryConfiguration",
            parameters: {
              id: new cdk.custom_resources.PhysicalResourceIdReference(),
              s3EnableHiveCompatiblePath: false,
              s3DeliveryConfiguration: {
                enableHiveCompatiblePath: true,
                suffixPath: logPrefix.logPrefix,
              },
            },
            service: "CloudWatchLogs",
          },
          onDelete: {
            action: "deleteDelivery",
            parameters: {
              id: new cdk.custom_resources.PhysicalResourceIdReference(),
            },
            service: "CloudWatchLogs",
          },
          policy: cdk.custom_resources.AwsCustomResourcePolicy.fromStatements([
            new cdk.aws_iam.PolicyStatement({
              actions: [
                "logs:CreateDelivery",
                "logs:DeleteDelivery",
                "logs:UpdateDeliveryConfiguration",
              ],
              resources: ["*"],
            }),
          ]),
        }
      );
    }

      const cloudFrontStandardLogDelivery = new cdk.aws_logs.CfnDelivery(
        this,
        "CloudFrontStandardLogDelivery",
        {
          deliverySourceName: cloudFrontStandardLogDeliverySource.name,
          deliveryDestinationArn:
            cloudFrontStandardLogDeliveryDestination.attrArn,
          s3EnableHiveCompatiblePath: false,
          s3SuffixPath: logPrefix.logPrefix.split(
            logPrefix.awsLogObjectPrefix
          )[1],
        }
      );

      // Constructパスが現時点の`cdk.out/manifest.json`内に存在する = 既にリソースが存在する = 更新処理と判断し、プレフィックス内の AWSLogs/<AWSアカウントID>/CloudFront がある状態で渡す
      if (this.resourceExists(cloudFrontStandardLogDelivery)) {
        cloudFrontStandardLogDelivery.s3SuffixPath = logPrefix.logPrefix;
      }
      console.log(
        `cloudFrontStandardLogDelivery.s3SuffixPath : ${cloudFrontStandardLogDelivery.s3SuffixPath}`
      );
    }
  }

  private resourceExists(resource: cdk.CfnResource): boolean {
    try {
      const manifestPath = path.join("cdk.out", "manifest.json");

      if (!fs.existsSync(manifestPath)) {
        console.log(
          "manifest.json does not exist. This might be the first deployment."
        );
        return false;
      }

      const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));

      const resourcePath = resource.cfnOptions?.metadata?.["aws:cdk:path"];
      if (!resourcePath) {
        console.log("Resource path not found in metadata");
        return false;
      }

      const resourceMetadata =
        manifest?.artifacts?.WebsiteStack?.metadata?.[`/${resourcePath}`];
      return resourceMetadata !== undefined;
    } catch (error) {
      console.log("Error checking resource existence:", error);
      return false;
    }
  }

px cdk diff --no-change-set
Bundling asset WebsiteStack/ContentsDeliveryConstruct/RewriteToWebpLambdaEdge/Code/Stage...

  cdk.out/bundling-temp-a0b0205c5ae59be4b27b17777568e9cab4257b303b38ab098d49bca58284c947/index.mjs  731b

⚡ Done in 9ms
cloudFrontStandardLogDelivery.s3SuffixPath : {DistributionId}/{yyyy}/{MM}/{dd}/{HH}
Stack WebsiteStack
Resources
[+] AWS::Logs::Delivery ContentsDeliveryConstruct/CloudFrontStandardLogDelivery ContentsDeliveryConstructCloudFrontStandardLogDelivery2C76C0AA

✨  Number of stacks with differences: 1

>  (feature/logging-v2 →⚡=) npx cdk diff --no-change-set
Bundling asset WebsiteStack/ContentsDeliveryConstruct/RewriteToWebpLambdaEdge/Code/Stage...

  cdk.out/bundling-temp-a0b0205c5ae59be4b27b17777568e9cab4257b303b38ab098d49bca58284c947/index.mjs  731b

⚡ Done in 11ms
update
cloudFrontStandardLogDelivery.s3SuffixPath : AWSLogs/<AWSアカウントID>/CloudFront/{DistributionId}/{yyyy}/{MM}/{dd}/{HH}
Stack WebsiteStack
Resources
[+] AWS::Logs::Delivery ContentsDeliveryConstruct/CloudFrontStandardLogDelivery ContentsDeliveryConstructCloudFrontStandardLogDelivery2C76C0AA

✨  Number of stacks with differences: 1

          onUpdate: {
            action: "updateDeliveryConfiguration",
            parameters: {
              id: new cdk.custom_resources.PhysicalResourceIdReference(),
              s3EnableHiveCompatiblePath: false,
              s3DeliveryConfiguration: {
+               enableHiveCompatiblePath: true,
                suffixPath: logPrefix.logPrefix,
              },
            },
            physicalResourceId:
              cdk.custom_resources.PhysicalResourceId.fromResponse(
                "delivery.id"
              ),
            service: "CloudWatchLogs",
          },