Added log-delivery-policy for s3-bucket component

[zdmytriv]

what

• Added log-delivery-policy for s3-bucket component

why

• log-delivery-policy is common policy that is being added to S3 bucket. For example:
  • https://docs.aws.amazon.com/network-firewall/latest/developerguide/logging-s3.html
  • https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-query-logs-choosing-target-resource.html

references

[aknysh]

LGTM, please see comments

[Nuru]

This description is wrong, right? This will be used when var.custom_policy_enabled is true.

[zdmytriv]

nope.

When custom_policy_enabled=true then policy from iam.tf this will be used.

When iam_policy_statements=true (and other 2 are false) then policy from iam-policy module will be used this

[aknysh]

see comments

[zdmytriv]

@Nuru please re-review

[Nuru]

@zdmytriv I appreciate the motivation behind this PR and the effort you put into it. I am, however, not inclined to accept this PR for a few reasons. (Although I'm using the "Request changes" feature, I'm not asking you to make changes to make the PR acceptable, I'm asking you to close the PR without merging.)

To begin with, the log delivery policy you have added is not the current "best practice" policy. The current best practice is to include conditionals on the source account and ARN to guard against the confused deputies problem. (See the link for more details.)

Next, the name "custom policy" of the input to the current component is a bit misleading. Both the custom policy and the default policy are user supplied policies, just with different formats. This component does not provide any pre-defined policies. Adding a pre-defined policy makes this component even more complicated, and invites future users to want to be able to combine custom and pre-defined policies in a way that will cause further confusion and headache.

Cloud Posse already provides other components and modules for log delivery buckets, such as vpc-flow-logs-bucket and cloudtrail-bucket to handle the cases where the S3 bucket is for log delivery. These are much easier to use because they are pre-tuned for specific purposes. This component (s3-bucket) is meant for maximum flexibility, and users can and should create their own policies for it.

So I suggest you use one of the other components that meets your needs and please close this PR.