False positive of AVD-AWS-0010 Configure Cloudfront logging

[LesterTheTester]

IDs

AVD-AWS-0010

Description

I am getting a false positive on AVD-AWS-0010 with trivy v0.45.0. I have configured all the parameters in the "good example"

cloudfront.tf

...
restrictions {
    geo_restriction {
        restriction_type = "none"
    }
  }

  logging_config { 
      include_cookies = false
      bucket          = module.log_bucket.s3_bucket_bucket_domain_name
      prefix          = "cloudfront"
  }

I receive:

MEDIUM: Distribution does not have logging enabled.
════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives
See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────
 cloudfront.tf:75
   via cloudfront.tf:73-77 (logging_config)
    via cloudfront.tf:1-78 (aws_cloudfront_distribution.dott-fast)
────────────────────────────────────────
   1   resource "aws_cloudfront_distribution" "dott-fast" {
   .   
  75 [       bucket          = module.log_bucket.s3_bucket_bucket_domain_name
  ..   
  78   }

Reproduction Steps

Run trivy on terraform code with aws_cloudfront_distribution as described above.

Target

Filesystem

Scanner

Misconfiguration

Target OS

No response

Debug Output

2023-09-14T13:52:27.083-0700    DEBUG   Severities: ["MEDIUM" "HIGH" "CRITICAL"]
2023-09-14T13:52:27.086-0700    DEBUG   cache dir:  /home/lester/.cache/trivy
2023-09-14T13:52:27.086-0700    INFO    Misconfiguration scanning is enabled
2023-09-14T13:52:27.086-0700    DEBUG   Failed to open the policy metadata: open /home/lester/.cache/trivy/policy/metadata.json: no such file or directory
2023-09-14T13:52:27.086-0700    INFO    Need to update the built-in policies
2023-09-14T13:52:27.086-0700    INFO    Downloading the built-in policies...
2023-09-14T13:52:27.086-0700    DEBUG   Using URL: ghcr.io/aquasecurity/defsec:0 to load policy bundle
/usr/bin/docker-credential-desktop.exe: Invalid argument
2023-09-14T13:52:27.183-0700    ERROR   Falling back to embedded policies: failed to download built-in policies: download error: OCI repository error: 1 error occurred:
        * error getting credentials - err: exit status 1, out: ``


2023-09-14T13:52:27.184-0700    DEBUG   Walk the file tree rooted at 'terraform/cloudfront.tf' in parallel
2023-09-14T13:52:27.184-0700    DEBUG   Scanning Terraform files for misconfigurations...
2023-09-14T13:52:27.671-0700    DEBUG   OS is not detected.
2023-09-14T13:52:27.671-0700    INFO    Detected config files: 3
2023-09-14T13:52:27.671-0700    DEBUG   Scanned config file: .
2023-09-14T13:52:27.671-0700    DEBUG   Scanned config file: cloudfront.tf
2023-09-14T13:52:27.671-0700    DEBUG   Scanned config file: terraform-aws-modules/s3-bucket/aws/main.tf

cloudfront.tf (terraform)

Tests: 6 (SUCCESSES: 4, FAILURES: 2, EXCEPTIONS: 0)
Failures: 2 (MEDIUM: 1, HIGH: 1, CRITICAL: 0)

MEDIUM: Distribution does not have logging enabled.
════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
You should configure CloudFront Access Logging to create log files that contain detailed information about every user request that CloudFront receives

See https://avd.aquasec.com/misconfig/avd-aws-0010
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 cloudfront.tf:75
   via cloudfront.tf:73-77 (logging_config)
    via cloudfront.tf:1-78 (aws_cloudfront_distribution.dott-fast)
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   resource "aws_cloudfront_distribution" "dott-fast" {
   .   
  75 [       bucket          = module.log_bucket.s3_bucket_bucket_domain_name
  ..   
  78   }
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Version

Version: 0.45.0

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[simar7]

cc @nikpivkin could you take a look?

[nikpivkin]

Hi @LesterTheTester !

Could you provide more information about the config?