ALB access-log bucket getting created despite disabled

This behavior is unusual as AWS doesn't automatically create S3 buckets for load balancer access logs by default. Access logs for load balancers (ALB, NLB, or Classic) need to be explicitly enabled, and you need to specify an existing S3 bucket where the logs should be stored.

When you enable access logs for a load balancer, AWS will create a test file named "ELBAccessLogTestFile" in the specified bucket path (typically under AWSLogs/[account-id]/) to verify that the permissions are set correctly. However, AWS should not be creating entire buckets automatically.

To disable access logs for your load balancer, you need to explicitly set the "Enabled" attribute to false in your load balancer configuration. For example, in a Classic Load Balancer configuration, the access log attribute would look like:

"AccessLog": {
"Enabled": false
}

Check your Terraform code to ensure there isn't another resource or module that might be enabling access logs. Also, verify if there are any organizational policies or AWS Config rules in your account that might be automatically enabling access logging for compliance reasons.

If you're certain that your Terraform code is correctly disabling access logs but buckets are still being created, you might want to check CloudTrail logs to see which entity or service is creating these buckets, as this is not standard AWS behavior.
Sources
Disable access logs for your Classic Load Balancer - Elastic Load Balancing
Enable access logs for your Application Load Balancer - Elastic Load Balancing

I agree with the Agent. The Bucket will NOT be created by AWS. Likely you will have something some where in your terraform creating the S3 resource

According to terraform documentation - the default value for access_logs is true. That is, you need to disable it.

Refer: https://registry.terraform.io/providers/rgeraskin/aws2/latest/docs/resources/elb#access_logs-1

Example:

resource "aws_lb" "example" {
  name               = "my-lb"
  internal           = false
  load_balancer_type = "application"
  subnets            = ["subnet-123", "subnet-456"]

  access_logs {
    enabled = false
  }
}