[aws-ec2] Accidental Log Group creation when creating a VPC

[155martinmoreno]

Describe the bug

When adding a VPC with:
const vpc = new ec2.Vpc(this, 'SomeVpc');

a Lambda function is created with the description:
Lambda function for removing all inbound/outbound rules from the VPC default security group
and immediately deleted after the deployment is finished.

The main problem this generates is that as a consequence of the Lambda, a Log Group is also created, with retention set to never expire.
When the stack is deleted, the Log Group remains.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

A way to configure log retention.

Current Behavior

When the stack is deleted, the Log Group remains.

Reproduction Steps

const vpc = new ec2.Vpc(this, 'SomeVpc');

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.156.0 (build 2966832)

Framework Version

No response

Node.js Version

v22.9.0

OS

OSX

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi,

This lambda function is a the custom resource provider. Just like other general lambda functions, it would create a default log group when publishing its initial log stream. The log group/stream won't be removed when the lambda func is destroyed. I understand your request, when destroy the stack, the log group of the custom resource provider should be cleaned up as well.

We can make it a feature request and I am requesting the team for a quick ack here.

   Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: cdk-hnb659fds-assets-ACCOUNT_ID-us-east-1
        S3Key: 7fa1e366ee8a9ded01fc355f704cff92bfd179574e6f9cfee800a3541df1b200.zip
      Timeout: 900
      MemorySize: 128
      Handler: __entrypoint__.handler
      Role:
        Fn::GetAtt:
          - CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0
          - Arn
      Runtime: nodejs20.x
      Description: Lambda function for removing all inbound/outbound rules from the VPC default security group
    DependsOn:
      - CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0
      -