feat(misconf): Adds CloudFront standard logging v2 support to AVD-AWS-0010 by Aakarsh133 · Pull Request #10848 · aquasecurity/trivy

Aakarsh133 · 2026-06-15T15:46:39Z

Description

This PR adds v2 logging support to AVD-AWS-0010.

Modified data model to include v2 logging struct
V2 delivery chains detection added to cloudformation and terraform
1. Implemented hasV2Logging as discussed as a helper to ensure smooth integration with original adapter.
2. types.BoolValue used instead of iacTypes.BoolValue in Terraform to follow the previous implementations in the file.
3. Different hasV2Logging helper at cloudformation as well s a clean solution to ensure minimal disruption to other implementations.
4. Directly integrated V2 logging struct with Logging at getDistributions
Added respective tests

Additional Notes

Lint fixed a few other lint related issues in the repo as well.

Related issues

Close feat(misconf): add CloudFront standard logging v2 support to AVD-AWS-0010 #10622

Related PRs

feat(misconf): Adds CloudFront standard logging v2 support to AVD-AWS-0010

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

CLAassistant · 2026-06-15T16:13:40Z

All committers have signed the CLA.

nikpivkin

Thanks, the implementation matches what we agreed on in #10622.

nikpivkin · 2026-06-16T05:41:36Z

+		logType := source.GetAttribute("log_type").AsStringValueOrDefault("", source)
+		if logType.Value() != "ACCESS_LOGS" {


This can be simplified to:

Suggested change

logType := source.GetAttribute("log_type").AsStringValueOrDefault("", source)

if logType.Value() != "ACCESS_LOGS" {

if !source.GetAttribute("log_type").Equals("ACCESS_LOGS") {

nikpivkin · 2026-06-16T05:47:46Z

 	}
 }

+func Test_adaptDistributionV2(t *testing.T) {


Could you add a negative case where the delivery source references the distribution and a delivery exists, but log_type is not ACCESS_LOGS (e.g. ERROR_LOGS) → expect false? Right now the log_type filter branch isn't covered, so a regression there would go unnoticed.

nikpivkin · 2026-06-16T05:48:43Z

+					},
+				},
+			},
+		},


Two cases missing here:

LogType other than ACCESS_LOGS → expect false (covers the LogType filter).

DeliverySourceName given as !Ref CloudFrontAccessLogsDeliverySource (logical ID) instead of the literal name → expect true.

nikpivkin · 2026-06-16T05:50:07Z

+		for _, delivery := range deliveries {
+			deliverySourceName := delivery.GetStringProperty("DeliverySourceName")
+			if deliverySourceName.Value() == sourceName.Value() || deliverySourceName.Value() == source.ID() {
+				return iacTypes.Bool(true, distribution.Metadata())


The metadata for LoggingV2.Enabled points at the distribution. When the chain is detected it would be more accurate to point it at the aws_cloudwatch_log_delivery resource (the AWS::Logs::Delivery on the CF side), since that's the link that actually completes the chain - a source on its own does not enable logging.

nikpivkin · 2026-06-16T05:50:51Z

          "$ref": "#/definitions/github.qkg1.top.aquasecurity.trivy.pkg.iac.providers.azure.appservice.Identity"
        },
-        "platform": {
+        "resource": {


Just flagging that this schema diff in azure.appservice.Service is unrelated to CloudFront. It's correct though — the Service model already uses Resource, so the committed schema was out of sync and the regeneration fixed it. Worth mentioning in the PR description so it doesn't look accidental.

nikpivkin · 2026-06-16T06:12:17Z

Before this is merged, we should verify the updated check works end to end with these model changes by running the integration tests. Since the Rego check lives in trivy-checks and relies on the new logging.v2.enabled field, please confirm the integration tests pass against the regenerated schema so we know the rule actually consumes the field correctly.

Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io>

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

nikpivkin · 2026-06-17T05:34:49Z

+
+		deliveries := modules.GetReferencingResources(source, "aws_cloudwatch_log_delivery", "delivery_source_name")
+		if len(deliveries) > 0 {
+			return types.Bool(true, metadata)


Just as in CF, it's best to return the aws_cloudwatch_log_delivery metadata.

Until now it was under assumption that merely an existence of a aws_cloudwatch_log_delivery would confirm the V2 to be true, here it didn't reference the specific resource explicitly, so in case at least one resource exists(usual case) should i do return types.Bool(true, deliveries[0].GetMetadata()). Is this the correct approach?

Yes, that's fine, since there's supposed to be at least one delivery resource here.

also just a note for both CF and Terraform in case of false, distribution metadata is returned

…eturns true Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

Aakarsh133 · 2026-06-18T09:42:07Z

I believe at Trivy-checks certain integration tests are bound to fail if they are checked as intended for now atleast, until the PRs are not merged. I have manually imported schemas, rego is working fine with them.
For the both repos I have done most of the tests I could find relevant if there is anything relevant left please let me know.

nikpivkin

LGTM. I reviewed the adapter changes and verified them e2e together with the corresponding trivy-checks PR aquasecurity/trivy-checks#580.

While testing this I simplified local development of the integration test so unreleased trivy changes can be validated against a locally built binary without building and pushing an image. That is in aquasecurity/trivy-checks#581.

Aakarsh133 added 7 commits June 11, 2026 22:19

feat(cloudfront): add v2 logging struct to data model

4431e31

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

chore(schema): regenerate cloud schema for cloudfront v2 logging

5469868

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

fix(terraform): detect cloudfront v2 log delivery chains

501e63c

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

fix(cloudformation): detect cloudfront v2 log delivery chains

ddf6ca5

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

test(terraform): add unit tests for v2 logging detection

2b97e16

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

test(cloudfront): add unit tests for v2 logging detection

6a4b3d5

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

fix(cloudformation) : Fixed lint issues.

fd3aa58

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

Aakarsh133 requested review from DmitriyLewen, knqyf263 and nikpivkin as code owners June 15, 2026 15:46

nikpivkin requested changes Jun 16, 2026

View reviewed changes

nikpivkin reviewed Jun 16, 2026

View reviewed changes

Comment thread pkg/iac/adapters/cloudformation/aws/cloudfront/distribution.go Outdated

Aakarsh133 and others added 6 commits June 16, 2026 22:05

Update pkg/iac/adapters/cloudformation/aws/cloudfront/distribution.go

c64562c

Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io>

fix(lint) Reverted lint changes

f3cba5a

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

fix(terraform) Optimized log_type check

3b2afa1

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

test(terraform) Added test case for non access log_type

2e07db1

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

test(cloudformation) Added additional tests

f960b34

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

fix(cloudformation) Updated metadata entry at hasV2Logging in true case

b3982d5

Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

nikpivkin reviewed Jun 17, 2026

View reviewed changes

fix(terraform) Updated metadata entry to delivery when hasV2Logging r…

2946f5b

…eturns true Signed-off-by: Aakarsh Maurya <mauryaaakarsh11@gmail.com>

coderabbitai Bot mentioned this pull request Jun 18, 2026

feat(ws3): IaC the frontend SPA edge (S3+CloudFront+ACM) in platform tier BinHsu/aegis-platform-aws#96

Merged

Aakarsh133 mentioned this pull request Jun 18, 2026

feat(misconf): Adds CloudFront standard logging v2 support to AVD-AWS-0010 aquasecurity/trivy-checks#580

Merged

3 tasks

nikpivkin approved these changes Jun 18, 2026

View reviewed changes

nikpivkin added this pull request to the merge queue Jun 18, 2026

Merged via the queue into aquasecurity:main with commit a848925 Jun 18, 2026
15 checks passed

repo-trivy-write-33ed3c Bot mentioned this pull request Jun 18, 2026

release: v0.72.0 [main] #10782

Merged

		logType := source.GetAttribute("log_type").AsStringValueOrDefault("", source)
		if logType.Value() != "ACCESS_LOGS" {

	logType := source.GetAttribute("log_type").AsStringValueOrDefault("", source)
	if logType.Value() != "ACCESS_LOGS" {
	if !source.GetAttribute("log_type").Equals("ACCESS_LOGS") {

Uh oh!

Conversation

Aakarsh133 commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Additional Notes

Related issues

Related PRs

Checklist

Uh oh!

CLAassistant commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nikpivkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nikpivkin Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nikpivkin commented Jun 16, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Aakarsh133 commented Jun 18, 2026

Uh oh!

nikpivkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Aakarsh133 commented Jun 15, 2026 •

edited

Loading

CLAassistant commented Jun 15, 2026 •

edited

Loading

nikpivkin Jun 16, 2026 •

edited

Loading