Pull request overview

Updates the S3 bucket policy applied when auto-enabling ELB/ALB access logging, aiming to remove region-specific ELB account-ID handling and rely on updated log-delivery principals.

Changes:

• Removed the hardcoded Region2ELBAccountId mapping and the conditional “old-region vs new-region” bucket policy branching.
• Updated LbResources.add_bucket_policy() signature and its call sites to no longer pass a region account ID.
• Fixed the classic ELB retry path to pass the correct LoadBalancerAttributes structure on the second modify_load_balancer_attributes call.

sumologic-app-utils/src/awsresource.py:907

• The load balancer log-delivery statements look inconsistent: the policy grants delivery.logs.amazonaws.com only s3:GetBucketAcl but no corresponding s3:PutObject, while the write permission is granted to logdelivery.elasticloadbalancing.amazonaws.com. If the LB log delivery path uses delivery.logs.amazonaws.com (as implied by the ACL check and the previous implementation), enabling access logs will continue to fail with AccessDenied even after calling add_bucket_policy. Consider restoring the delivery.logs.amazonaws.com write statement (with the bucket-owner-full-control ACL condition) and keeping the logdelivery.elasticloadbalancing.amazonaws.com write statement for newer regions.

                "Sid": "AWSAlbLogDeliveryAclCheck",
                "Effect": "Allow",
                "Principal": {
                    "Service": "delivery.logs.amazonaws.com"
                },

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

LGTM