fix: Check standard logs in AwsSolutions-CFR3

src/rules/cloudfront/CloudFrontDistributionAccessLogging.ts

@@ -8,7 +8,11 @@ import {
   CfnDistribution,
   CfnStreamingDistribution,
 } from 'aws-cdk-lib/aws-cloudfront';
+import { CfnDeliverySource } from 'aws-cdk-lib/aws-logs';
 import { NagRuleCompliance, NagRules } from '../../nag-rules';
+import { flattenCfnReference } from '../../utils/flatten-cfn-reference';
+
+const pendingDistributions: CfnDistribution[] = [];
 
 /**
  * CloudFront distributions have access logging enabled
@@ -21,7 +25,10 @@ export default Object.defineProperty(
         node.distributionConfig
       );
       if (distributionConfig.logging == undefined) {
-        return NagRuleCompliance.NON_COMPLIANT;
+        pendingDistributions.push(node);
+        // TODO: If there are no CfnDeliverySource defined, then mark as NON_COMPLIANT,
+        // otherwise mark as NOT_APPLICABLE to continue in the next step
+        return NagRuleCompliance.NOT_APPLICABLE;
       }
       return NagRuleCompliance.COMPLIANT;
     } else if (node instanceof CfnStreamingDistribution) {
@@ -37,6 +44,28 @@ export default Object.defineProperty(
         return NagRuleCompliance.NON_COMPLIANT;
       }
       return NagRuleCompliance.COMPLIANT;
+    } else if (node instanceof CfnDeliverySource) {
+      return pendingDistributions.every((distributionNode) => {
+        const distributionArn = flattenCfnReference(
+          Stack.of(distributionNode).resolve(
+            Stack.of(distributionNode).formatArn({
+              service: 'cloudfront',
+              region: '',
+              resource: 'distribution',
+              resourceName: distributionNode.attrId,
+            })
+          )
+        ).replace('.Id', '');
+        const deliverySourceArn = flattenCfnReference(
+          Stack.of(node).resolve(node.resourceArn)
+        );
+        const logType = Stack.of(node).resolve(node.logType);
+        return (
+          distributionArn === deliverySourceArn && logType === 'ACCESS_LOGS'
+        );
+      })
+        ? NagRuleCompliance.COMPLIANT
+        : NagRuleCompliance.NON_COMPLIANT;
     } else {
       return NagRuleCompliance.NOT_APPLICABLE;
     }

test/rules/CloudFront.test.ts

@@ -16,6 +16,12 @@ import {
   S3Origin,
   S3BucketOrigin,
 } from 'aws-cdk-lib/aws-cloudfront-origins';
+import {
+  CfnDelivery,
+  CfnDeliveryDestination,
+  CfnDeliverySource,
+  LogGroup,
+} from 'aws-cdk-lib/aws-logs';
 import { Bucket } from 'aws-cdk-lib/aws-s3';
 import { CfnWebACL } from 'aws-cdk-lib/aws-wafv2';
 import { Aspects, Stack } from 'aws-cdk-lib/core';
@@ -108,6 +114,45 @@ describe('Amazon CloudFront', () => {
       });
       validateStack(stack, ruleId, TestType.COMPLIANCE);
     });
+    test.only('Compliance 2', () => {
+      const distribution = new Distribution(stack, 'Distribution', {
+        defaultBehavior: {
+          origin: new S3Origin(new Bucket(stack, 'OriginBucket')),
+        },
+      });
+
+      const distributionDeliverySource = new CfnDeliverySource(
+        stack,
+        'DistributionDeliverySource',
+        {
+          name: 'distribution-logs-source',
+          logType: 'ACCESS_LOGS',
+          resourceArn: Stack.of(stack).formatArn({
+            service: 'cloudfront',
+            region: '',
+            resource: 'distribution',
+            resourceName: distribution.distributionId,
+          }),
+        }
+      );
+
+      const distributionDeliveryDestination = new CfnDeliveryDestination(
+        stack,
+        'DistributionDeliveryDestination',
+        {
+          name: 'distribution-logs-destination',
+          destinationResourceArn: new LogGroup(stack, 'DistributionLogGroup')
+            .logGroupArn,
+          outputFormat: 'json',
+        }
+      );
+
+      new CfnDelivery(stack, 'DistributionDelivery', {
+        deliverySourceName: distributionDeliverySource.name,
+        deliveryDestinationArn: distributionDeliveryDestination.attrArn,
+      }).node.addDependency(distributionDeliverySource);
+      validateStack(stack, ruleId, TestType.COMPLIANCE);
+    });
   });
 
   describe('CloudFrontDistributionGeoRestrictions: CloudFront distributions may require Geo restrictions', () => {