custom resources: Generated step function generates finding due to missing logging

[rv2673]

Describe the bug

When custom resources with provider framework has a completedHandler function it generates a aws step function for polling for completion with a configured interval and total timeout.

This generated step function however has no logging configuration. Which causes the StepFunctions.1 rule from the AWS Foundational Security Best Practices (FSBP) standard set to be triggered.

This is due to the missing logging configuration. The provider construct however also does not provide any option to configure this logging.

Expected Behavior

The provider construct adds logging by default following the foundational best practice and/or allows this to be configured.

Current Behavior

The provider construct does not add logging configuration on step function nor does it allow for it to be configured through construct props.

Reproduction Steps

Enable StepFunctions.1 rule.
Create stack with custom resource with both evenHandler and isCompleteHandler to trigger generation of state machine.
Deploy generated template
This template should triggger the rule due to missing logging configuration

Possible Solution

• Add logging configuration by default (with logRetention from props if provided)
• And/or allow for loggroup (configuration) to be provided to provider construct for use in state machine.

Additional Information/Context

No response

CDK CLI Version

2.96.0

Framework Version

No response

Node.js Version

18

OS

Ubuntu 20.04

Language

Typescript

Language Version

No response

Other information

No response

[pahud]

Yes we should add logging here by default unless disabled.

aws-cdk/packages/aws-cdk-lib/custom-resources/lib/provider-framework/waiter-state-machine.ts

Lines 80 to 83 in 1fd22a7

	properties: {
	DefinitionString: definition,
	RoleArn: role.roleArn,
	},

Before it is supported, you can work it around with addPropertyOverride() as below to configure the loggingConfigurations.

const provider = new cr.Provider(this, 'Provider', {
	onEventHandler,
	isCompleteHandler,
	
});

const logGroup = new LogGroup(this, 'LogGroup');

const waiterStateMachine = provider.node.tryFindChild('waiter-state-machine') as Construct
const cfnstateMachine = waiterStateMachine.node.tryFindChild('Resource') as CfnResource
cfnstateMachine.addPropertyOverride('LoggingConfiguration', {
	'CloudWatchLogsLogGroup': {
		'LogGroupArn': logGroup.logGroupArn,
	}
})

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.