fix: Check standard logs in AwsSolutions-CFR3

.projenrc.js

@@ -6,7 +6,7 @@ const { awscdk, vscode } = require('projen');
 const project = new awscdk.AwsCdkConstructLibrary({
   author: 'Arun Donti',
   authorAddress: '[email protected]',
-  cdkVersion: '2.156.0',
+  cdkVersion: '2.167.0',
   defaultReleaseBranch: 'main',
   majorVersion: 2,
   npmDistTag: 'latest',

src/rules/cloudfront/CloudFrontDistributionAccessLogging.ts

@@ -8,7 +8,9 @@ import {
   CfnDistribution,
   CfnStreamingDistribution,
 } from 'aws-cdk-lib/aws-cloudfront';
+import { CfnDelivery, CfnDeliverySource } from 'aws-cdk-lib/aws-logs';
 import { NagRuleCompliance, NagRules } from '../../nag-rules';
+import { flattenCfnReference } from '../../utils/flatten-cfn-reference';
 
 /**
  * CloudFront distributions have access logging enabled
@@ -21,6 +23,44 @@ export default Object.defineProperty(
         node.distributionConfig
       );
       if (distributionConfig.logging == undefined) {
+        const distributionArn = flattenCfnReference(
+          Stack.of(node).resolve(
+            Stack.of(node).formatArn({
+              service: 'cloudfront',
+              region: '',
+              resource: 'distribution',
+              resourceName: node.attrId,
+            })
+          )
+        ).replace('.Id', '');
+
+        let deliverySourceName;
+        for (const child of Stack.of(node).node.findAll()) {
+          if (child instanceof CfnDeliverySource) {
+            const deliverySourceArn = flattenCfnReference(
+              Stack.of(child).resolve(child.resourceArn)
+            );
+            const logType = Stack.of(child).resolve(child.logType);
+            if (
+              deliverySourceArn === distributionArn &&
+              logType === 'ACCESS_LOGS'
+            ) {
+              deliverySourceName = Stack.of(child).resolve(child.name);
+            }
+          }
+        }
+
+        for (const child of Stack.of(node).node.findAll()) {
+          if (child instanceof CfnDelivery) {
+            if (
+              deliverySourceName ===
+              Stack.of(child).resolve(child.deliverySourceName)
+            ) {
+              return NagRuleCompliance.COMPLIANT;
+            }
+          }
+        }
+
         return NagRuleCompliance.NON_COMPLIANT;
       }
       return NagRuleCompliance.COMPLIANT;

test/rules/CloudFront.test.ts

@@ -16,6 +16,12 @@ import {
   S3Origin,
   S3BucketOrigin,
 } from 'aws-cdk-lib/aws-cloudfront-origins';
+import {
+  CfnDelivery,
+  CfnDeliveryDestination,
+  CfnDeliverySource,
+  LogGroup,
+} from 'aws-cdk-lib/aws-logs';
 import { Bucket } from 'aws-cdk-lib/aws-s3';
 import { CfnWebACL } from 'aws-cdk-lib/aws-wafv2';
 import { Aspects, Stack } from 'aws-cdk-lib/core';
@@ -76,6 +82,49 @@ describe('Amazon CloudFront', () => {
       });
       validateStack(stack, ruleId, TestType.NON_COMPLIANCE);
     });
+    test('Noncompliance 3', () => {
+      const distribution1 = new Distribution(stack, 'Distribution1', {
+        defaultBehavior: {
+          origin: new S3Origin(new Bucket(stack, 'OriginBucket1')),
+        },
+      });
+      new Distribution(stack, 'Distribution2', {
+        defaultBehavior: {
+          origin: new S3Origin(new Bucket(stack, 'OriginBucket2')),
+        },
+      });
+      const distributionDeliverySource = new CfnDeliverySource(
+        stack,
+        'DistributionDeliverySource',
+        {
+          name: 'distribution-logs-source',
+          logType: 'ACCESS_LOGS',
+          resourceArn: Stack.of(stack).formatArn({
+            service: 'cloudfront',
+            region: '',
+            resource: 'distribution',
+            resourceName: distribution1.distributionId,
+          }),
+        }
+      );
+
+      const distributionDeliveryDestination = new CfnDeliveryDestination(
+        stack,
+        'DistributionDeliveryDestination',
+        {
+          name: 'distribution-logs-destination',
+          destinationResourceArn: new LogGroup(stack, 'DistributionLogGroup')
+            .logGroupArn,
+          outputFormat: 'json',
+        }
+      );
+
+      new CfnDelivery(stack, 'DistributionDelivery', {
+        deliverySourceName: distributionDeliverySource.name,
+        deliveryDestinationArn: distributionDeliveryDestination.attrArn,
+      }).node.addDependency(distributionDeliverySource);
+      validateStack(stack, ruleId, TestType.NON_COMPLIANCE);
+    });
     test('Compliance', () => {
       const logsBucket = new Bucket(stack, 'LoggingBucket');
       new Distribution(stack, 'Distribution', {
@@ -108,6 +157,81 @@ describe('Amazon CloudFront', () => {
       });
       validateStack(stack, ruleId, TestType.COMPLIANCE);
     });
+    test('Compliance 2', () => {
+      const distribution = new Distribution(stack, 'Distribution', {
+        defaultBehavior: {
+          origin: new S3Origin(new Bucket(stack, 'OriginBucket')),
+        },
+      });
+
+      const distributionDeliverySource = new CfnDeliverySource(
+        stack,
+        'DistributionDeliverySource',
+        {
+          name: 'distribution-logs-source',
+          logType: 'ACCESS_LOGS',
+          resourceArn: Stack.of(stack).formatArn({
+            service: 'cloudfront',
+            region: '',
+            resource: 'distribution',
+            resourceName: distribution.distributionId,
+          }),
+        }
+      );
+
+      const distributionDeliveryDestination = new CfnDeliveryDestination(
+        stack,
+        'DistributionDeliveryDestination',
+        {
+          name: 'distribution-logs-destination',
+          destinationResourceArn: new LogGroup(stack, 'DistributionLogGroup')
+            .logGroupArn,
+          outputFormat: 'json',
+        }
+      );
+
+      new CfnDelivery(stack, 'DistributionDelivery', {
+        deliverySourceName: distributionDeliverySource.name,
+        deliveryDestinationArn: distributionDeliveryDestination.attrArn,
+      }).node.addDependency(distributionDeliverySource);
+      validateStack(stack, ruleId, TestType.COMPLIANCE);
+    });
+    test('Compliance 2', () => {
+      const distribution = new Distribution(stack, 'Distribution', {
+        defaultBehavior: {
+          origin: new S3Origin(new Bucket(stack, 'OriginBucket')),
+        },
+      });
+
+      const distributionDeliveryDestination = new CfnDeliveryDestination(
+        stack,
+        'DistributionDeliveryDestination',
+        {
+          name: 'distribution-logs-destination',
+          destinationResourceArn: new LogGroup(stack, 'DistributionLogGroup')
+            .logGroupArn,
+          outputFormat: 'json',
+        }
+      );
+
+      new CfnDelivery(stack, 'DistributionDelivery', {
+        deliverySourceName: 'distribution-logs-source',
+        deliveryDestinationArn: distributionDeliveryDestination.attrArn,
+      });
+
+      new CfnDeliverySource(stack, 'DistributionDeliverySource', {
+        name: 'distribution-logs-source',
+        logType: 'ACCESS_LOGS',
+        resourceArn: Stack.of(stack).formatArn({
+          service: 'cloudfront',
+          region: '',
+          resource: 'distribution',
+          resourceName: distribution.distributionId,
+        }),
+      });
+
+      validateStack(stack, ruleId, TestType.COMPLIANCE);
+    });
   });
 
   describe('CloudFrontDistributionGeoRestrictions: CloudFront distributions may require Geo restrictions', () => {