Skip to content

feat(misconf): Adds CloudFront standard logging v2 support to AVD-AWS-0010 #10848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nikpivkin merged 14 commits into from
Jun 18, 2026
+333 −2
Merged

feat(misconf): Adds CloudFront standard logging v2 support to AVD-AWS-0010 #10848

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
4431e31
feat(cloudfront): add v2 logging struct to data model
Aakarsh133 Jun 11, 2026
5469868
chore(schema): regenerate cloud schema for cloudfront v2 logging
Aakarsh133 Jun 11, 2026
501e63c
fix(terraform): detect cloudfront v2 log delivery chains
Aakarsh133 Jun 11, 2026
ddf6ca5
fix(cloudformation): detect cloudfront v2 log delivery chains
Aakarsh133 Jun 12, 2026
2b97e16
test(terraform): add unit tests for v2 logging detection
Aakarsh133 Jun 12, 2026
6a4b3d5
test(cloudfront): add unit tests for v2 logging detection
Aakarsh133 Jun 13, 2026
fd3aa58
fix(cloudformation) : Fixed lint issues.
Aakarsh133 Jun 14, 2026
c64562c
Update pkg/iac/adapters/cloudformation/aws/cloudfront/distribution.go
Aakarsh133 Jun 16, 2026
f3cba5a
fix(lint) Reverted lint changes
Aakarsh133 Jun 16, 2026
3b2afa1
fix(terraform) Optimized log_type check
Aakarsh133 Jun 16, 2026
2e07db1
test(terraform) Added test case for non access log_type
Aakarsh133 Jun 16, 2026
f960b34
test(cloudformation) Added additional tests
Aakarsh133 Jun 16, 2026
b3982d5
fix(cloudformation) Updated metadata entry at hasV2Logging in true case
Aakarsh133 Jun 16, 2026
2946f5b
fix(terraform) Updated metadata entry to delivery when hasV2Logging r…
Aakarsh133 Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pkg/fanal/test/integration/containerd_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -803,11 +803,11 @@ func TestContainerd_PullImage(t *testing.T) {
},
History: []v1.History{
{
Created: v1.Time{time.Date(2019, 8, 20, 20, 19, 55, 62606894, time.UTC)},
Created: v1.Time{Time: time.Date(2019, 8, 20, 20, 19, 55, 62606894, time.UTC)},
Comment thread
Aakarsh133 marked this conversation as resolved.
Outdated
CreatedBy: "/bin/sh -c #(nop) ADD file:fe64057fbb83dccb960efabbf1cd8777920ef279a7fa8dbca0a8801c651bdf7c in / ",
},
{
Created: v1.Time{time.Date(2019, 8, 20, 20, 19, 55, 211423266, time.UTC)},
Created: v1.Time{Time: time.Date(2019, 8, 20, 20, 19, 55, 211423266, time.UTC)},
CreatedBy: "/bin/sh -c #(nop) CMD [\"/bin/sh\"]",
EmptyLayer: true,
},
Expand Down
76 changes: 76 additions & 0 deletions pkg/iac/adapters/cloudformation/aws/cloudfront/cloudfront_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,82 @@ Resources:
Distributions: []cloudfront.Distribution{{}},
},
},

{
name: "v2 logging configured",
source: `AWSTemplateFormatVersion: 2010-09-09
Resources:
CloudFrontDistribution:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
DefaultCacheBehavior:
ViewerProtocolPolicy: "redirect-to-https"

CloudFrontAccessLogsDeliverySource:
Type: AWS::Logs::DeliverySource
Properties:
LogType: ACCESS_LOGS
Name: cloudfront-log-delivery-source
ResourceArn: !Sub
- arn:aws:cloudfront::${AWS::AccountId}:distribution/${D}
- D: !GetAtt CloudFrontDistribution.Id

CloudFrontAccessLogsDelivery:
Type: AWS::Logs::Delivery
Properties:
DeliverySourceName: cloudfront-log-delivery-source
`,
expected: cloudfront.Cloudfront{
Distributions: []cloudfront.Distribution{
{
Logging: cloudfront.Logging{
V2: cloudfront.LoggingV2{
Enabled: types.BoolTest(true),
},
},
DefaultCacheBehaviour: cloudfront.CacheBehaviour{
ViewerProtocolPolicy: types.StringTest("redirect-to-https"),
},
},
},
},
},
{
name: "v2 logging source exists but no delivery",
source: `AWSTemplateFormatVersion: 2010-09-09
Resources:
CloudFrontDistribution:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
DefaultCacheBehavior:
ViewerProtocolPolicy: "redirect-to-https"

CloudFrontAccessLogsDeliverySource:
Type: AWS::Logs::DeliverySource
Properties:
LogType: ACCESS_LOGS
Name: cloudfront-log-delivery-source
ResourceArn: !Sub
- arn:aws:cloudfront::${AWS::AccountId}:distribution/${D}
- D: !GetAtt CloudFrontDistribution.Id
`,
expected: cloudfront.Cloudfront{
Distributions: []cloudfront.Distribution{
{
Logging: cloudfront.Logging{
V2: cloudfront.LoggingV2{
Enabled: types.BoolTest(false),
},
},
DefaultCacheBehaviour: cloudfront.CacheBehaviour{
ViewerProtocolPolicy: types.StringTest("redirect-to-https"),
},
},
},
},
},

@nikpivkin nikpivkin Jun 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two cases missing here:

  1. LogType other than ACCESS_LOGS → expect false (covers the LogType filter).
  2. DeliverySourceName given as !Ref CloudFrontAccessLogsDeliverySource (logical ID) instead of the literal name → expect true.

}

for _, tt := range tests {
Expand Down
33 changes: 33 additions & 0 deletions pkg/iac/adapters/cloudformation/aws/cloudfront/distribution.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,18 @@
package cloudfront

import (
"strings"

"github.com/aquasecurity/trivy/pkg/iac/providers/aws/cloudfront"
"github.com/aquasecurity/trivy/pkg/iac/scanners/cloudformation/parser"
iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
)

func getDistributions(ctx parser.FileContext) (distributions []cloudfront.Distribution) {

distributionResources := ctx.GetResourcesByType("AWS::CloudFront::Distribution")
deliverySources := ctx.GetResourcesByType("AWS::Logs::DeliverySource")
deliveries := ctx.GetResourcesByType("AWS::Logs::Delivery")

for _, r := range distributionResources {
distribution := cloudfront.Distribution{
Expand All @@ -16,6 +21,10 @@ func getDistributions(ctx parser.FileContext) (distributions []cloudfront.Distri
Logging: cloudfront.Logging{
Metadata: r.Metadata(),
Bucket: r.GetStringProperty("DistributionConfig.Logging.Bucket"),
V2: cloudfront.LoggingV2{
Metadata: r.Metadata(),
Enabled: hasV2Logging(r, deliverySources, deliveries),
},
},
DefaultCacheBehaviour: getDefaultCacheBehaviour(r),
OrdererCacheBehaviours: nil,
Expand Down Expand Up @@ -43,3 +52,27 @@ func getDefaultCacheBehaviour(r *parser.Resource) cloudfront.CacheBehaviour {
ViewerProtocolPolicy: defaultCache.GetStringProperty("ViewerProtocolPolicy"),
}
}

func hasV2Logging(distribution *parser.Resource, deliverySources, deliveries []*parser.Resource) iacTypes.BoolValue {

for _, source := range deliverySources {
logType := source.GetStringProperty("LogType")
if logType.Value() != "ACCESS_LOGS" {
Comment thread
Aakarsh133 marked this conversation as resolved.
Outdated
continue
}
resourceArn := source.GetStringProperty("ResourceArn")
if !strings.Contains(resourceArn.Value(), distribution.ID()) {
continue
}
sourceName := source.GetStringProperty("Name")

for _, delivery := range deliveries {
deliverySourceName := delivery.GetStringProperty("DeliverySourceName")
if deliverySourceName.Value() == sourceName.Value() || deliverySourceName.Value() == source.ID() {
return iacTypes.Bool(true, distribution.Metadata())

@nikpivkin nikpivkin Jun 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The metadata for LoggingV2.Enabled points at the distribution. When the chain is detected it would be more accurate to point it at the aws_cloudwatch_log_delivery resource (the AWS::Logs::Delivery on the CF side), since that's the link that actually completes the chain - a source on its own does not enable logging.

}
}

}
return iacTypes.Bool(false, distribution.Metadata())
}
29 changes: 28 additions & 1 deletion pkg/iac/adapters/terraform/aws/cloudfront/adapt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,14 @@ func adaptDistributions(modules terraform.Modules) []cloudfront.Distribution {
var distributions []cloudfront.Distribution
for _, module := range modules {
for _, resource := range module.GetResourcesByType("aws_cloudfront_distribution") {
distributions = append(distributions, adaptDistribution(resource))
distribution := adaptDistribution(resource)

distribution.Logging.V2 = cloudfront.LoggingV2{
Metadata: resource.GetMetadata(),
Enabled: hasV2Logging(modules, resource),
}

distributions = append(distributions, distribution)
}
}
return distributions
Expand Down Expand Up @@ -77,3 +84,23 @@ func adaptDistribution(resource *terraform.Block) cloudfront.Distribution {

return distribution
}

func hasV2Logging(modules terraform.Modules, distributionBlock *terraform.Block) types.BoolValue {
metadata := distributionBlock.GetMetadata()

sources := modules.GetReferencingResources(distributionBlock, "aws_cloudwatch_log_delivery_source", "resource_arn")
for _, source := range sources {
logType := source.GetAttribute("log_type").AsStringValueOrDefault("", source)
if logType.Value() != "ACCESS_LOGS" {

@nikpivkin nikpivkin Jun 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be simplified to:

Suggested change
logType := source.GetAttribute("log_type").AsStringValueOrDefault("", source)
if logType.Value() != "ACCESS_LOGS" {
if !source.GetAttribute("log_type").Equals("ACCESS_LOGS") {

continue
}

deliveries := modules.GetReferencingResources(source, "aws_cloudwatch_log_delivery", "delivery_source_name")
if len(deliveries) > 0 {
return types.Bool(true, metadata)

@nikpivkin nikpivkin Jun 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just as in CF, it's best to return the aws_cloudwatch_log_delivery metadata.

@Aakarsh133 Aakarsh133 Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Until now it was under assumption that merely an existence of a aws_cloudwatch_log_delivery would confirm the V2 to be true, here it didn't reference the specific resource explicitly, so in case at least one resource exists(usual case) should i do return types.Bool(true, deliveries[0].GetMetadata()). Is this the correct approach?

@nikpivkin nikpivkin Jun 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's fine, since there's supposed to be at least one delivery resource here.

@Aakarsh133 Aakarsh133 Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also just a note for both CF and Terraform in case of false, distribution metadata is returned

}
}

return types.Bool(false, metadata)

}
66 changes: 66 additions & 0 deletions pkg/iac/adapters/terraform/aws/cloudfront/adapt_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,72 @@ func Test_adaptDistribution(t *testing.T) {
}
}

func Test_adaptDistributionV2(t *testing.T) {

@nikpivkin nikpivkin Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add a negative case where the delivery source references the distribution and a delivery exists, but log_type is not ACCESS_LOGS (e.g. ERROR_LOGS) → expect false? Right now the log_type filter branch isn't covered, so a regression there would go unnoticed.

tests := []struct {
name string
terraform string
expected cloudfront.Distribution
}{
{
name: "v2 logging configured",
terraform: `
resource "aws_cloudfront_distribution" "example" {}

resource "aws_cloudwatch_log_delivery_source" "example" {
log_type = "ACCESS_LOGS"
resource_arn = aws_cloudfront_distribution.example.arn
}

resource "aws_cloudwatch_log_delivery" "example" {
delivery_source_name = aws_cloudwatch_log_delivery_source.example.name
}
`,
expected: cloudfront.Distribution{
Logging: cloudfront.Logging{
V2: cloudfront.LoggingV2{
Enabled: iacTypes.BoolTest(true),
},
},
DefaultCacheBehaviour: cloudfront.CacheBehaviour{},
ViewerCertificate: cloudfront.ViewerCertificate{
MinimumProtocolVersion: iacTypes.StringTest("TLSv1"),
},
},
},
{
name: "v2 logging source exists but no delivery",
terraform: `
resource "aws_cloudfront_distribution" "example" {}

resource "aws_cloudwatch_log_delivery_source" "example" {
log_type = "ACCESS_LOGS"
resource_arn = aws_cloudfront_distribution.example.arn
}
`,
expected: cloudfront.Distribution{
Logging: cloudfront.Logging{
V2: cloudfront.LoggingV2{
Enabled: iacTypes.BoolTest(false),
},
},
DefaultCacheBehaviour: cloudfront.CacheBehaviour{},
ViewerCertificate: cloudfront.ViewerCertificate{
MinimumProtocolVersion: iacTypes.StringTest("TLSv1"),
},
},
},
}

for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
modules := tftestutil.CreateModulesFromSource(t, test.terraform, ".tf")
adapted := Adapt(modules)
require.Len(t, adapted.Distributions, 1)
testutil.AssertDefsecEqual(t, test.expected, adapted.Distributions[0])
})
}
}

func TestLines(t *testing.T) {
src := `
resource "aws_cloudfront_distribution" "example" {
Expand Down
6 changes: 6 additions & 0 deletions pkg/iac/providers/aws/cloudfront/cloudfront.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,15 @@ type Distribution struct {
ViewerCertificate ViewerCertificate
}

type LoggingV2 struct {
Metadata iacTypes.Metadata
Enabled iacTypes.BoolValue
}

type Logging struct {
Metadata iacTypes.Metadata
Bucket iacTypes.StringValue
V2 LoggingV2
}

type CacheBehaviour struct {
Expand Down
19 changes: 18 additions & 1 deletion pkg/iac/rego/schemas/cloud.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -944,6 +944,23 @@
"bucket": {
"type": "object",
"$ref": "#/definitions/github.qkg1.top.aquasecurity.trivy.pkg.iac.types.StringValue"
},
"v2": {
"type": "object",
"$ref": "#/definitions/github.qkg1.top.aquasecurity.trivy.pkg.iac.providers.aws.cloudfront.LoggingV2"
}
}
},
"github.qkg1.top.aquasecurity.trivy.pkg.iac.providers.aws.cloudfront.LoggingV2": {
"type": "object",
"properties": {
"__defsec_metadata": {
"type": "object",
"$ref": "#/definitions/github.qkg1.top.aquasecurity.trivy.pkg.iac.types.Metadata"
},
"enabled": {
"type": "object",
"$ref": "#/definitions/github.qkg1.top.aquasecurity.trivy.pkg.iac.types.BoolValue"
}
}
},
Expand Down Expand Up @@ -4566,7 +4583,7 @@
"type": "object",
"$ref": "#/definitions/github.qkg1.top.aquasecurity.trivy.pkg.iac.providers.azure.appservice.Identity"
},
"platform": {
"resource": {

@nikpivkin nikpivkin Jun 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just flagging that this schema diff in azure.appservice.Service is unrelated to CloudFront. It's correct though — the Service model already uses Resource, so the committed schema was out of sync and the regeneration fixed it. Worth mentioning in the PR description so it doesn't look accidental.

"type": "object",
"$ref": "#/definitions/github.qkg1.top.aquasecurity.trivy.pkg.iac.types.StringValue"
},
Expand Down