Fix/own account cleanup

infra/cdk/src/main/java/sample/com/constructs/CfnPreDeleteCleanup.java

@@ -21,8 +21,8 @@
 /**
  * CfnPreDeleteCleanup construct for cleaning up resources before stack deletion.
  * - GuardDuty VPC endpoints that block VPC deletion
- * - CloudWatch log groups with workshop- or unicornstore- prefix
  * - S3 bucket contents for workshop- buckets
+ * Its own log group belongs to the stack (Lambda.stackLogGroup), like every function's.
  */
 public class CfnPreDeleteCleanup extends Construct {
 
@@ -120,7 +120,8 @@ public CfnPreDeleteCleanup(final Construct scope, final String id, final CfnPreD
             .code(Code.fromInline(loadFile("/lambda/cfn-pre-delete-cleanup.py")))
             .role(lambdaRole)
             .timeout(Duration.minutes(10))
-            .description("Cleanup VPC endpoints, CloudWatch logs, and S3 buckets before stack deletion")
+            .logGroup(Lambda.stackLogGroup(this, "FunctionLogGroup"))
+            .description("Cleanup VPC endpoints and S3 buckets before stack deletion")
             .build();
 
         // Create Custom Resource that triggers cleanup on stack delete

infra/cdk/src/main/java/sample/com/constructs/CodeBuild.java

@@ -103,6 +103,11 @@ public CodeBuild(final Construct scope, final String id, final CodeBuildProps pr
             .buildSpec(BuildSpec.fromObjectToYaml(new Yaml().load(props.getBuildSpec())))
             .environmentVariables(codeBuildEnvVars)
             .timeout(props.getTimeout())
+            .logging(LoggingOptions.builder()
+                .cloudWatch(CloudWatchLoggingOptions.builder()
+                    .logGroup(Lambda.stackLogGroup(this, "ProjectLogGroup"))
+                    .build())
+                .build())
             .build();
 
         lambdaRole.addToPolicy(PolicyStatement.Builder.create()

infra/cdk/src/main/java/sample/com/constructs/Ide.java

@@ -424,7 +424,9 @@ public Ide(final Construct scope, final String id, final IdeProps props) {
         String gitBranch = props.getGitBranch();
         String templateType = props.getTemplateType();
 
-        // Load UserData from external template file and substitute variables
+        // Load UserData from external template file and substitute variables. The bootstrap log
+        // group belongs to the stack, so it is deleted with it (after the instance).
+        var bootstrapLogGroup = Lambda.stackLogGroup(this, "BootstrapLogGroup");
         String userDataTemplate = loadFile("/userdata.sh");
         String userDataContent = userDataTemplate
             .replace("${GIT_BRANCH}", gitBranch)
@@ -436,6 +438,7 @@ public Ide(final Construct scope, final String id, final IdeProps props) {
             .replace("${ARCH}", props.getIdeArch().getUnameValue())
             .replace("${IDE_TYPE}", props.getIdeType().getScriptName())
             .replace("${WAIT_CONDITION_HANDLE_URL}", waitHandle.getRef())
+            .replace("${LOG_GROUP_NAME}", bootstrapLogGroup.getLogGroupName())
             .replace("${PREFIX}", prefix);
 
         userData.addCommands(userDataContent);
@@ -578,6 +581,7 @@ private String getIdePassword(String instanceName) {
                 .runtime(Runtime.PYTHON_3_13)
                 .timeout(Duration.minutes(3))
                 .functionName(prefix + "-ide-password")
+                .logGroup(Lambda.stackLogGroup(this, "PasswordFunctionLogGroup"))
                 .build();
 
             ideSecretsManagerPassword.grantRead(passwordFunction);

infra/cdk/src/main/java/sample/com/constructs/Lambda.java

@@ -1,10 +1,13 @@
 package sample.com.constructs;
 
 import software.amazon.awscdk.Duration;
+import software.amazon.awscdk.RemovalPolicy;
 import software.amazon.awscdk.services.iam.Role;
 import software.amazon.awscdk.services.lambda.Code;
 import software.amazon.awscdk.services.lambda.Function;
 import software.amazon.awscdk.services.lambda.Runtime;
+import software.amazon.awscdk.services.logs.LogGroup;
+import software.amazon.awscdk.services.logs.RetentionDays;
 import software.constructs.Construct;
 
 import java.io.IOException;
@@ -58,6 +61,20 @@ public Lambda(final Construct scope, final String id, final LambdaProps props, f
             .timeout(props.getTimeout())
             .functionName(props.getFunctionName())
             .role(props.getRole())
+            .logGroup(stackLogGroup(this, "LogGroup"))
+            .build();
+    }
+
+    /**
+     * A log group the stack owns: CloudFormation deletes it after the function that writes
+     * to it, so the logs of a custom resource's Delete call go too. Without it, Lambda
+     * creates /aws/lambda/<name> itself and the group outlives the stack. The name is
+     * generated, so a group left by an earlier deployment can't block the create.
+     */
+    public static LogGroup stackLogGroup(final Construct scope, final String id) {
+        return LogGroup.Builder.create(scope, id)
+            .retention(RetentionDays.ONE_WEEK)
+            .removalPolicy(RemovalPolicy.DESTROY)
             .build();
     }
 

infra/cdk/src/main/java/sample/com/constructs/Unicorn.java

@@ -82,6 +82,7 @@ private void createDatabaseSetup(UnicornProps props) {
             .timeout(Duration.minutes(3))
             .vpc(props.getVpc())
             .securityGroups(List.of(database.getDatabaseSecurityGroup()))
+            .logGroup(Lambda.stackLogGroup(this, "UnicornStoreDatabaseSetupLogGroup"))
             .build();
 
         // Grant permissions to setup function

infra/cdk/src/main/resources/userdata.sh

@@ -18,8 +18,8 @@ export IDE_TYPE="${IDE_TYPE}"
 export WAIT_CONDITION_HANDLE_URL="${WAIT_CONDITION_HANDLE_URL}"
 export PREFIX="${PREFIX}"
 
-# Setup logging - use PREFIX for log group name
-LOG_GROUP_NAME="${PREFIX}-ide-bootstrap-$(date +%Y%m%d-%H%M%S)"
+# Setup logging into the stack's bootstrap log group (Ide.java), deleted with the stack
+LOG_GROUP_NAME="${LOG_GROUP_NAME}"
 echo "Bootstrap logs will be written to CloudWatch log group: $LOG_GROUP_NAME"
 
 # Install CloudWatch agent for logging