feat: add optional S3 access logging for Control Tower compliance (CT.S3.PR.2)

Add optional s3_access_logs_bucket_arn parameter to sagemaker-templates
and sagemaker-model-cicd modules. When provided, all S3 buckets created
by these modules will configure server access logging to the specified
bucket, satisfying the CT.S3.PR.2 proactive control that blocks bucket
creation without logging in Control Tower environments.

Key changes:
- sagemaker-templates: Wire parameter through settings/stack to
  xgboost_abalone (2 buckets) and batch_inference (1 bucket)
- sagemaker-model-cicd: Wire parameter through Zod schema/props to
  all 3 pipeline artifact buckets and the LogsBucket
- Log prefixes include project/pipeline/bucket names for disambiguation
  when multiple module instances share the same logging bucket
- CDK Nag AwsSolutions-S1 suppressions are conditional: only applied
  when logging is not configured
- Unit tests cover both logging-enabled and logging-disabled paths

Author: weklund

modules/sagemaker/sagemaker-model-cicd/bin/seedfarmer-parameters.ts

@@ -58,6 +58,8 @@ export function getModuleParameters() {
   const deploymentGroups = getSeedFarmerParamter('DEPLOYMENT_GROUPS');
   const permissionsBoundaryName =
     process.env.SEEDFARMER_PARAMETER_PERMISSIONS_BOUNDARY_NAME;
+  const s3AccessLogsBucketArn =
+    process.env.SEEDFARMER_PARAMETER_S3_ACCESS_LOGS_BUCKET_ARN;
 
   // validate parameters
   try {
@@ -67,6 +69,7 @@ export function getModuleParameters() {
       modelBuildRepo,
       deploymentGroups,
       permissionsBoundaryName,
+      s3AccessLogsBucketArn,
     });
   } catch (err) {
     const validationError = fromError(err, {

modules/sagemaker/sagemaker-model-cicd/lib/code-pipeline/mlops-code-pipeline-stack-props.ts

@@ -123,6 +123,11 @@ export const MLOpsCodePipelinePropsSchema = z.object({
    * IAM Policy Name to attach to all roles as permissions boundary.
    */
   permissionsBoundaryName: z.string().optional(),
+  /**
+   * S3 bucket ARN for server access logging. When provided, all S3 buckets
+   * will be configured to send access logs to this bucket.
+   */
+  s3AccessLogsBucketArn: z.string().optional(),
 });
 
 export type MLOpsCodePipelineStackProps = z.infer<

modules/sagemaker/sagemaker-model-cicd/lib/code-pipeline/mlops-code-pipeline-stack.ts

@@ -53,6 +53,7 @@ export class MLOpsCodePipelineStack extends cdk.Stack {
       modelBuildRepo,
       deploymentGroups,
       tags,
+      s3AccessLogsBucketArn,
     } = props;
 
     // get the infra codecommit repo that will be used as source for model deploy codepipeline
@@ -78,7 +79,7 @@ export class MLOpsCodePipelineStack extends cdk.Stack {
         // this pipeline will already be updated during `seedfarmer apply`
         selfMutation: false,
         crossAccountKeys: true,
-        artifactBucket: utils.createPipelineArtifactsBucket(this),
+        artifactBucket: utils.createPipelineArtifactsBucket(this, s3AccessLogsBucketArn, `${projectName}-infra-pipeline-artifacts/`),
         synth: new cdk.pipelines.CodeBuildStep('Synth', {
           input: cdk.pipelines.CodePipelineSource.codeCommit(
             this.infraRepo,
@@ -127,6 +128,7 @@ export class MLOpsCodePipelineStack extends cdk.Stack {
           modelPackageGroupName,
           modelApprovalTopicName: modelApprovalNotificationsTopicName,
           deployEnvironments,
+          s3AccessLogsBucketArn,
           // Model build support resources stack should be deployed to model build account
           env: {
             account: buildEnvironment.account,
@@ -153,6 +155,7 @@ export class MLOpsCodePipelineStack extends cdk.Stack {
           sagemakerExecutionRoleName,
           codeBuildAssumeRoleName,
           modelPackageGroupName,
+          s3AccessLogsBucketArn,
           // this pipeline should be created in tooling account, which will trigger the model build in target account
           env: toolingEnvironment,
           description: `Model build pipeline for ${projectName} ${deploymentGroup.name}`,
@@ -175,6 +178,7 @@ export class MLOpsCodePipelineStack extends cdk.Stack {
           deploymentGroup,
           modelPackageGroupName,
           sagemakerArtifactsBucketName,
+          s3AccessLogsBucketArn,
           // this pipeline should be created in tooling account, which will trigger the model deploy in target accounts
           env: toolingEnvironment,
           description: `Model deploy pipeline for ${projectName} ${deploymentGroup.name}`,

modules/sagemaker/sagemaker-model-cicd/lib/code-pipeline/model-build-support/model-build-support-stack.ts

@@ -6,6 +6,7 @@ import * as kms from 'aws-cdk-lib/aws-kms';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as sagemaker from 'aws-cdk-lib/aws-sagemaker';
 import * as sns from 'aws-cdk-lib/aws-sns';
+import { NagSuppressions } from 'cdk-nag';
 import { Construct } from 'constructs';
 import { DeployEnvironment } from '../mlops-code-pipeline-stack-props';
 
@@ -18,6 +19,7 @@ export interface ModelBuildSupportStackProps extends cdk.StackProps {
   readonly modelPackageGroupName: string;
   readonly modelApprovalTopicName: string;
   readonly deployEnvironments: DeployEnvironment[];
+  readonly s3AccessLogsBucketArn?: string;
 }
 
 export class ModelBuildSupportStack extends cdk.Stack {
@@ -39,6 +41,7 @@ export class ModelBuildSupportStack extends cdk.Stack {
       modelApprovalTopicName,
       deployEnvironments,
       toolingEnvironment,
+      s3AccessLogsBucketArn,
     } = props;
 
     const deploymentAccountPrincipals: iam.AccountPrincipal[] =
@@ -87,14 +90,29 @@ export class ModelBuildSupportStack extends cdk.Stack {
       targetKey: kmsKey,
     });
 
+    const accessLogsBucket = s3AccessLogsBucketArn
+      ? s3.Bucket.fromBucketArn(this, 'AccessLogsBucket', s3AccessLogsBucketArn)
+      : undefined;
+
     const logsBucket = new s3.Bucket(this, 'LogsBucket', {
       encryption: s3.BucketEncryption.KMS,
       encryptionKey: kmsKey,
       removalPolicy: cdk.RemovalPolicy.DESTROY,
       autoDeleteObjects: true,
       enforceSSL: true,
+      serverAccessLogsBucket: accessLogsBucket,
+      serverAccessLogsPrefix: accessLogsBucket ? `${sagemakerArtifactsBucketName}-logs/` : undefined,
     });
 
+    if (!accessLogsBucket) {
+      NagSuppressions.addResourceSuppressions(logsBucket, [
+        {
+          id: 'AwsSolutions-S1',
+          reason: 'This is itself a logging bucket; enabling access logs would create a circular dependency.',
+        },
+      ]);
+    }
+
     const sagemakerArtifactsBucket = new s3.Bucket(this, 'ArtifactsBucket', {
       bucketName: sagemakerArtifactsBucketName,
       encryption: s3.BucketEncryption.KMS,

modules/sagemaker/sagemaker-model-cicd/lib/code-pipeline/model-build/model-build-code-pipeline-stack.ts

@@ -19,6 +19,7 @@ export interface ModelBuildCodePipelineProps extends cdk.StackProps {
   readonly sagemakerExecutionRoleName: string;
   readonly codeBuildAssumeRoleName: string;
   readonly modelPackageGroupName: string;
+  readonly s3AccessLogsBucketArn?: string;
 }
 
 export class ModelBuildCodePipelineStack extends cdk.Stack {
@@ -118,7 +119,7 @@ export class ModelBuildCodePipelineStack extends cdk.Stack {
 
     const buildPipeline = new codepipeline.Pipeline(this, 'BuildPipeline', {
       pipelineName,
-      artifactBucket: utils.createPipelineArtifactsBucket(this),
+      artifactBucket: utils.createPipelineArtifactsBucket(this, props.s3AccessLogsBucketArn, `${pipelineName}-artifacts/`),
     });
     this.pipeline = buildPipeline;
 

modules/sagemaker/sagemaker-model-cicd/lib/code-pipeline/model-deploy/model-deploy-code-pipeline-stack.ts

@@ -28,6 +28,7 @@ export interface ModelDeployCodePipelineStackProps extends cdk.StackProps {
   readonly ssmParamName?: string;
   readonly modelPackageGroupName: string;
   readonly sagemakerArtifactsBucketName: string;
+  readonly s3AccessLogsBucketArn?: string;
 }
 
 export class ModelDeployCodePipelineStack extends cdk.Stack {
@@ -89,7 +90,7 @@ export class ModelDeployCodePipelineStack extends cdk.Stack {
       // this pipeline will be updated by project-infra pipeline
       selfMutation: false,
       crossAccountKeys: true,
-      artifactBucket: utils.createPipelineArtifactsBucket(this),
+      artifactBucket: utils.createPipelineArtifactsBucket(this, props.s3AccessLogsBucketArn, `${pipelineName}-artifacts/`),
       synth: new cdk.pipelines.CodeBuildStep('Synth', {
         input: cdk.pipelines.CodePipelineSource.codeCommit(
           infraRepo,

modules/sagemaker/sagemaker-model-cicd/lib/utils/pipeline-artifacts-bucket.ts

@@ -4,7 +4,11 @@ import * as s3 from 'aws-cdk-lib/aws-s3';
 import { NagSuppressions } from 'cdk-nag';
 import { Construct } from 'constructs';
 
-export function createPipelineArtifactsBucket(scope: Construct): s3.Bucket {
+export function createPipelineArtifactsBucket(
+  scope: Construct,
+  s3AccessLogsBucketArn?: string,
+  logsPrefix?: string,
+): s3.Bucket {
   const removalPolicy = cdk.RemovalPolicy.DESTROY;
   const autoDeleteObjects = removalPolicy === cdk.RemovalPolicy.DESTROY;
 
@@ -17,6 +21,10 @@ export function createPipelineArtifactsBucket(scope: Construct): s3.Bucket {
     },
   );
 
+  const accessLogsBucket = s3AccessLogsBucketArn
+    ? s3.Bucket.fromBucketArn(scope, 'PipelineAccessLogsBucket', s3AccessLogsBucketArn)
+    : undefined;
+
   const pipelineArtifactsBucket = new s3.Bucket(
     scope,
     'PipelineArtifactBucket',
@@ -26,13 +34,17 @@ export function createPipelineArtifactsBucket(scope: Construct): s3.Bucket {
       autoDeleteObjects,
       bucketKeyEnabled: true,
       enforceSSL: true,
+      serverAccessLogsBucket: accessLogsBucket,
+      serverAccessLogsPrefix: accessLogsBucket ? (logsPrefix || 'pipeline-artifacts/') : undefined,
     },
   );
-  NagSuppressions.addResourceSuppressions(pipelineArtifactsBucket, [
-    {
-      id: 'AwsSolutions-S1',
-      reason: 'The bucket stores pipeline artifacts, no logging required.',
-    },
-  ]);
+  if (!accessLogsBucket) {
+    NagSuppressions.addResourceSuppressions(pipelineArtifactsBucket, [
+      {
+        id: 'AwsSolutions-S1',
+        reason: 'The bucket stores pipeline artifacts, no logging required.',
+      },
+    ]);
+  }
   return pipelineArtifactsBucket;
 }

modules/sagemaker/sagemaker-model-cicd/test/__snapshots__/model-build-support-stack.test.ts.snap

@@ -604,6 +604,16 @@ exports[`ModelBuildSupportStack to match snapshot 1`] = `
     },
     "LogsBucket9C4D8843": {
       "DeletionPolicy": "Delete",
+      "Metadata": {
+        "cdk_nag": {
+          "rules_to_suppress": [
+            {
+              "id": "AwsSolutions-S1",
+              "reason": "This is itself a logging bucket; enabling access logs would create a circular dependency.",
+            },
+          ],
+        },
+      },
       "Properties": {
         "AccessControl": "LogDeliveryWrite",
         "BucketEncryption": {

modules/sagemaker/sagemaker-model-cicd/test/mlops-code-pipeline-stack.test.ts

@@ -2,69 +2,87 @@ import * as cdk from 'aws-cdk-lib';
 import { Template } from 'aws-cdk-lib/assertions';
 import { MLOpsCodePipelineStack } from '../lib';
 
-test('MLOpsCodePipelineStack to match snapshot', () => {
-  const app = new cdk.App();
-  const stack = new MLOpsCodePipelineStack(app, 'MyTestStack', {
-    env: { account: '123456789011', region: 'us-east-1' }, // tooling account
-    projectName: 'TestProject',
-    deploymentGroups: [
-      // experimenation deployment group to train model on test dataset
-      {
-        name: 'experimenation-deployment-group',
-        sourceBranch: 'dev',
-        buildEnvironment: {
-          name: 'experiment-env1',
-          account: '123456789012',
-          region: 'us-east-1',
-          type: 'dev',
-        },
-        deployEnvironments: [
-          {
-            name: 'experiment-env2',
-            account: '123456789013',
-            type: 'dev',
-          },
-          {
-            name: 'experiment-env3',
-            account: '123456789014',
-            type: 'dev',
-          },
-        ],
+const baseProps = {
+  env: { account: '123456789011', region: 'us-east-1' }, // tooling account
+  projectName: 'TestProject',
+  deploymentGroups: [
+    // experimenation deployment group to train model on test dataset
+    {
+      name: 'experimenation-deployment-group',
+      sourceBranch: 'dev',
+      buildEnvironment: {
+        name: 'experiment-env1',
+        account: '123456789012',
+        region: 'us-east-1',
+        type: 'dev' as const,
       },
-      // prod deployment group with retraining on prod dataset
-      {
-        name: 'prod-deployment-group',
-        sourceBranch: 'main',
-        buildEnvironment: {
-          name: 'prod-train-env',
-          account: '123456789015',
-          region: 'us-east-1',
-          type: 'preprod',
+      deployEnvironments: [
+        {
+          name: 'experiment-env2',
+          account: '123456789013',
+          type: 'dev' as const,
         },
-        deployEnvironments: [
-          {
-            name: 'prod-approval-env',
-            account: '123456789016',
-            type: 'preprod',
-          },
-          {
-            name: 'prod-env',
-            account: '123456789017',
-            type: 'prod',
-          },
-        ],
-      },
-    ],
-    modelBuildRepo: {
-      host: 'codecommit',
-      name: 'model-build-repo',
+        {
+          name: 'experiment-env3',
+          account: '123456789014',
+          type: 'dev' as const,
+        },
+      ],
     },
-    infraRepo: {
-      host: 'codecommit',
-      name: 'model-deploy-repo',
-      branch: 'main',
+    // prod deployment group with retraining on prod dataset
+    {
+      name: 'prod-deployment-group',
+      sourceBranch: 'main',
+      buildEnvironment: {
+        name: 'prod-train-env',
+        account: '123456789015',
+        region: 'us-east-1',
+        type: 'preprod' as const,
+      },
+      deployEnvironments: [
+        {
+          name: 'prod-approval-env',
+          account: '123456789016',
+          type: 'preprod' as const,
+        },
+        {
+          name: 'prod-env',
+          account: '123456789017',
+          type: 'prod' as const,
+        },
+      ],
     },
-  });
+  ],
+  modelBuildRepo: {
+    host: 'codecommit' as const,
+    name: 'model-build-repo',
+  },
+  infraRepo: {
+    host: 'codecommit' as const,
+    name: 'model-deploy-repo',
+    branch: 'main',
+  },
+};
+
+test('MLOpsCodePipelineStack to match snapshot', () => {
+  const app = new cdk.App();
+  const stack = new MLOpsCodePipelineStack(app, 'MyTestStack', baseProps);
   const template = Template.fromStack(stack);
   expect(template.toJSON()).toMatchSnapshot();
 });
+
+test('MLOpsCodePipelineStack with s3AccessLogsBucketArn configures logging on artifact bucket', () => {
+  const app = new cdk.App();
+  const stack = new MLOpsCodePipelineStack(app, 'MyTestStack', {
+    ...baseProps,
+    s3AccessLogsBucketArn: 'arn:aws:s3:::test-access-logs-bucket',
+  });
+  const template = Template.fromStack(stack);
+
+  template.hasResourceProperties('AWS::S3::Bucket', {
+    LoggingConfiguration: {
+      DestinationBucketName: 'test-access-logs-bucket',
+      LogFilePrefix: 'TestProject-infra-pipeline-artifacts/',
+    },
+  });
+});