<p>I want to configure AWS NLB to store logs at the S3 bucket?
I have:</p>
<ul>
<li>AWS EKS cluster (v1.15),</li>
<li>NLB (created by Nginx controller),</li>
<li>S3 bucket with AIM (done as described here: <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-access-logs.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-access-logs.html</a>).</li>
</ul>
<p>I've added these annotations to my terraform code to nginx ingress:</p>
<pre><code>set {
  name  = &quot;controller.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-access-log-enabled&quot;
  value = &quot;true&quot;
}
set {
  name  = &quot;controller.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-access-log-s3-bucket-name&quot;
  value = &quot;nlb-logs-bucket&quot;
}
set {
  name  = &quot;controller.service.annotations.service\\.beta\\.kubernetes\\.io/aws-load-balancer-access-log-s3-bucket-prefix&quot;
  value = &quot;/nlblogs&quot;
}
</code></pre>
<p>I see that annotations are added to the controller, but in AWS console NLB settings didn't change (logs aren't saving to the bucket).</p>

<p>I've found a solution. I hope, it will help anybody.</p>
<p>As I understand, mentioned above annotations are only for ELB, and they don't work for NLB. I tried to update EKS to 1.16 and 1.17. It works for ELB, but not for NLB.</p>
<p>So, the solution is - to use local-exec provision in Terraform for k8s. At least it works for me.</p>
<p>Here is the code:</p>
<pre><code>resource &quot;null_resource&quot; &quot;enable_s3_bucket_logging_on_nlb&quot; {
  triggers = { &lt;TRIGGERS&gt; }
  provisioner &quot;local-exec&quot; {
    command = &lt;&lt;EOS
for i in $(aws elbv2 describe-load-balancers --region=&lt;REGION&gt; --names=$(echo ${data.kubernetes_service.nginx_ingress.load_balancer_ingress.0.hostname} |cut -d- -f1) | \
jq &quot;.[][] | { LoadBalancerArn: .LoadBalancerArn }&quot; |awk '{print $2}' |tr -d '&quot;'); do \
aws elbv2 modify-load-balancer-attributes --region=&lt;REGION&gt; --load-balancer-arn $i --attributes Key=access_logs.s3.enabled,Value=true \
Key=access_logs.s3.bucket,Value=nlb-logs-bucket Key=access_logs.s3.prefix,Value=nlblogs;\
done; \
EOS
  }
}
</code></pre>
<p>where:</p>
<ul>
<li>&lt;TRIGGERS&gt; - condition for the trigger</li>
<li>&lt;REGION&gt; - region of your NLB</li>
</ul>
