Check: CKV_AWS_84: "Ensure Elasticsearch Domain Logging is enabled"

Describe the bug My TF module has enabled logging for all types: “INDEX_SLOW_LOGS, SEARCH_SLOW_LOGS, ES_APPLICATION_LOGS, AUDIT_LOGS”, but I still got error:

Check: CKV_AWS_84: "Ensure Elasticsearch Domain Logging is enabled"
	FAILED for resource: aws_elasticsearch_domain.es
	File: /tf.json:0-0
	Guide: https://docs.bridgecrew.io/docs/elasticsearch_7

Elasticserach module:

resource "aws_elasticsearch_domain" "es" {
  domain_name           = var.elasticsearch_domain
  elasticsearch_version = var.elasticsearch_version

  cluster_config {
    instance_type          = var.instance_type
    instance_count         = var.instance_count
    zone_awareness_enabled = var.availability_zone_count == 1 ? false : true
    dynamic "zone_awareness_config" {
      for_each = null_resource.azs[*].triggers
      content {
        availability_zone_count = zone_awareness_config.value.availability_zone_count
      }
    }
  }

  vpc_options {
    subnet_ids = var.subnet_ids

    security_group_ids = [
      aws_security_group.elasticsearch_sg.id,
    ]
  }

  ebs_options {
    ebs_enabled = true
    volume_size = var.instance_volume_size
  }

  encrypt_at_rest {
    enabled = var.encrypt_at_rest ? true : false
    kms_key_id = var.kms_key_id != null ? var.kms_key_id : null
  }

  domain_endpoint_options {
    enforce_https = var.enforce_https
    tls_security_policy = var.enforce_https ? var.tls_security_policy : null
  }

  log_publishing_options {
    enabled                  = var.log_publishing ? true : false
    cloudwatch_log_group_arn = var.log_publishing ? aws_cloudwatch_log_group.elasticsearch-app-logs[0].arn : null
    log_type                 = var.log_publishing ? "ES_APPLICATION_LOGS" : null
  }

  log_publishing_options {
    enabled                  = var.log_publishing ? true : false
    cloudwatch_log_group_arn = var.log_publishing ? aws_cloudwatch_log_group.elasticsearch-slow-logs[0].arn : null
    log_type                 = var.log_publishing ? "INDEX_SLOW_LOGS" : null
  }

  log_publishing_options {
    enabled                  = var.log_publishing ? true : false
    cloudwatch_log_group_arn = var.log_publishing ? aws_cloudwatch_log_group.elasticsearch-audit-logs[0].arn : null
    log_type                 = var.log_publishing ? "AUDIT_LOGS" : null
  }

  log_publishing_options {
    enabled                  = var.log_publishing ? true : false
    cloudwatch_log_group_arn = var.log_publishing ? aws_cloudwatch_log_group.elasticsearch-search-slow-logs[0].arn : null
    log_type                 = var.log_publishing ? "AUDIT_LOGS" : null
  }

  access_policies = <<CONFIG
{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Action": "es:*",
          "Principal": "*",
          "Effect": "Allow",
          "Resource": "arn:aws:es:${var.aws_region}:${data.aws_caller_identity.current.account_id}:domain/${var.elasticsearch_domain}/*"
      }
  ]
}
CONFIG

  snapshot_options {
    automated_snapshot_start_hour = var.elasticsearch_snapshot_time
  }

  depends_on = [
    aws_iam_service_linked_role.es
  ]

  tags = merge(var.tags, {
    Domain = var.elasticsearch_domain
  })
}

CW Log Groups, Policy, etc are created. Variable “log_publishing” by default = true. Module deployed successfully and logging enabled, but “checkov” check not passed.

Expected behavior All types of logs are enabled, check must be passed.

Desktop:

• OS: macOS Big Sur 11.2.1
• Checkov Version: 2.0.86

[gruebel]

After further investigation, I found the issue. Since the Log Group is created in the same configuration and referenced here, the current logic doesn’t consider this at the moment.

[coffeecoco]

i still have this issue so opening a new issue