Grant CloudWatch Logs export permission on the release artifacts bucket

The LogsPuller CodeBuild project exports build logs to the release artifacts
bucket via `aws logs create-export-task`. That call is made by the CloudWatch
Logs service (not the CodeBuild role), so the destination bucket must grant the
logs service principal s3:GetBucketAcl and s3:PutObject via a bucket policy. The
(externally-managed) release bucket had no such policy, so every export failed
with "AccessDeniedException ... CreateExportTask: GetBucketAcl call on the given
bucket failed."

Add an AWS::S3::BucketPolicy for the release artifacts bucket granting the
CloudWatch Logs service principal GetBucketAcl + PutObject, scoped with
aws:SourceAccount and aws:SourceArn (the CodeBuild log group). The bucket has
ACLs disabled (BucketOwnerEnforced), so no s3:x-amz-acl condition is used.

Also harden buildspecs/pull-logs.yml: fail the build when a log export task
cannot be created (empty task id) or ends FAILED/CANCELLED. Previously these
errors were swallowed and the build reported SUCCEEDED while exporting zero logs.

Signed-off-by: Harish Senthilkumar <harishxr@amazon.com>

Author: Harish Senthilkumar

build-infrastructure/release-pipeline-stack.yml

@@ -899,6 +899,43 @@ Resources:
           Status: ENABLED
           StreamName: !Ref CopyCodeBuildProjectName
 
+  # CloudWatch Logs exports (LogsPuller, via `aws logs create-export-task`) to the
+  # release artifacts bucket are performed by the CloudWatch Logs *service*, not the
+  # CodeBuild role. So the (externally-managed) release bucket must grant the logs
+  # service principal s3:GetBucketAcl + s3:PutObject via a bucket policy; without it
+  # the export fails with "AccessDeniedException ... GetBucketAcl call on the given
+  # bucket failed". The bucket has ACLs disabled (BucketOwnerEnforced), so no
+  # s3:x-amz-acl condition is used.
+  ReleaseArtifactsBucketLogExportPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties:
+      Bucket: !Ref ReleaseArtifactsBucketName
+      PolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Sid: AllowCloudWatchLogsExportGetBucketAcl
+            Effect: Allow
+            Principal:
+              Service: !Sub 'logs.${AWS::Region}.amazonaws.com'
+            Action: s3:GetBucketAcl
+            Resource: !Ref ReleaseArtifactsBucketArn
+            Condition:
+              StringEquals:
+                aws:SourceAccount: !Ref 'AWS::AccountId'
+              ArnLike:
+                aws:SourceArn: !GetAtt CodeBuildLogGroup.Arn
+          - Sid: AllowCloudWatchLogsExportPutObject
+            Effect: Allow
+            Principal:
+              Service: !Sub 'logs.${AWS::Region}.amazonaws.com'
+            Action: s3:PutObject
+            Resource: !Sub '${ReleaseArtifactsBucketArn}/*'
+            Condition:
+              StringEquals:
+                aws:SourceAccount: !Ref 'AWS::AccountId'
+              ArnLike:
+                aws:SourceArn: !GetAtt CodeBuildLogGroup.Arn
+
   BuildAndSignCodePipelineServiceRole:
     Type: AWS::IAM::Role
     Properties:

buildspecs/pull-logs.yml

@@ -57,13 +57,28 @@ phases:
             --destination $RELEASE_BUCKET_NAME \
             --destination-prefix "$GIT_COMMIT_SHA/logs" | jq -r '.taskId')
 
+          # Fail loudly if the export task was not created (e.g. the destination
+          # bucket is missing the CloudWatch Logs service bucket policy). Previously
+          # this was swallowed and the build reported SUCCEEDED while exporting no logs.
+          if [ -z "$export_task_id" ] || [ "$export_task_id" = "null" ]; then
+            echo "ERROR: failed to create log export task for $build_id" >&2
+            return 1
+          fi
+
           echo "log export task for $build_id started with $export_task_id"
           echo "wait for export to finish..." && sleep $DEFAULT_SLEEP_DURATION_IN_SECONDS
 
           # use the given task id to look up the status, log the status later
           local export_task_status=$(aws logs describe-export-tasks --task-id $export_task_id | jq -r '.exportTasks[] | .status | .code')
 
           echo "log export task for $build_id (task $export_task_id) has status $export_task_status after $DEFAULT_SLEEP_DURATION_IN_SECONDS seconds"
+
+          # RUNNING/PENDING/COMPLETED are fine; a terminal failure is a hard error.
+          if [ "$export_task_status" = "FAILED" ] || [ "$export_task_status" = "CANCELLED" ]; then
+            echo "ERROR: log export task $export_task_id for $build_id ended in status $export_task_status" >&2
+            return 1
+          fi
+
           echo "wait so we don't get throttled..." && sleep $DEFAULT_SLEEP_DURATION_IN_SECONDS
           echo -e "-------------------------------------------------\n"
         }
@@ -82,5 +97,5 @@ phases:
       # CodeBuild project to the same string in the CloudFormation template
       - |
         source /tmp/functions.sh && for build_id in $EXTRACT_BUILD_ID $AMD_BUILD_ID $ARM_BUILD_ID $SIGNING_BUILD_ID $COPY_BUILD_ID; do
-          export_and_describe $(echo $build_id | sed -r 's/:/\//g')
+          export_and_describe $(echo $build_id | sed -r 's/:/\//g') || exit 1
         done