Repository: awslabs/cdk-serverless-clamscan (language: python)

Issue:
BUG : Virus definition logging bucket does not allow passing an imported bucket
### What is the problem?

Cdk Serverless Clamscan construct does not accept an imported Bucket resource passed as a target for access logs created for Virus Definition bucket.

```
jsii.errors.JSIIError: Value did not match any type in union: Expected a boolean, got {"$jsii.byref":"aws-cdk-lib.aws_s3.BucketBase@10006"}, Object of type aws-cdk-lib.aws_s3.BucketBase is not convertible to aws-cdk-lib.aws_s3.Bucket
```

### Reproduction Steps

```python
#!/usr/bin/env python3
import aws_cdk as cdk
from aws_cdk import Aspects
from aws_cdk import aws_s3 as s3
from cdk_nag import AwsSolutionsChecks
from cdk_serverless_clamscan import ServerlessClamscan, ServerlessClamscanLoggingProps
from constructs import Construct

class BucketStack(cdk.Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        s3_access_logs_bucket = s3.Bucket(
            self,
            "rS3AccessLogsBucket",
            block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
            bucket_name=f"s3-access-logs-{self.account}-{self.region}",
            encryption=s3.BucketEncryption.S3_MANAGED,
            enforce_ssl=True,
            versioned=True,
        )

        cdk.CfnOutput(
            self,
            "oS3AccessLogsBucketArn",
            export_name="oS3AccessLogsBucketArn",
            value=s3_access_logs_bucket.bucket_arn,
        )


class AntiVirusStack(cdk.Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        s3_access_logs_bucket = s3.Bucket.from_bucket_arn(
            self,
            "rS3AccessLogsBucket",
            bucket_arn=cdk.Fn.import_value("oS3AccessLogsBucketArn"),
        )

        ServerlessClamscan(
            self,
            "antivirus-scanning",
            defs_bucket_access_logs_config=ServerlessClamscanLoggingProps(
                logs_bucket=s3_access_logs_bucket,
                logs_prefix=f"s3-access-logs-{self.account}-{self.region}",
            ),
        )


app = cdk.App()
BucketStack(app, "BucketStack")
AntiVirusStack(app, "AntiVirusStack")

Aspects.of(app).add(AwsSolutionsChecks())
app.synth()
```


### What did you expect to happen?
I expected the cdk construct to accept an imported bucket being passed as a target for access logging for the Virus Definitions bucket

### cdk-serverless-clamscan version
2.1.26

### Language
Python

### Other information

BUG : Virus definition logging bucket does not allow passing an imported bucket
### What is the problem?

Cdk Serverless Clamscan construct does not accept an imported Bucket resource passed as a target for access logs created for Virus Definition bucket.

```
jsii.errors.JSIIError: Value did not match any type in union: Expected a boolean, got {"$jsii.byref":"aws-cdk-lib.aws_s3.BucketBase@10006"}, Object of type aws-cdk-lib.aws_s3.BucketBase is not convertible to aws-cdk-lib.aws_s3.Bucket
```

### Reproduction Steps

```python
#!/usr/bin/env python3
import aws_cdk as cdk
from aws_cdk import Aspects
from aws_cdk import aws_s3 as s3
from cdk_nag import AwsSolutionsChecks
from cdk_serverless_clamscan import ServerlessClamscan, ServerlessClamscanLoggingProps
from constructs import Construct

class BucketStack(cdk.Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        s3_access_logs_bucket = s3.Bucket(
            self,
            "rS3AccessLogsBucket",
            block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
            bucket_name=f"s3-access-logs-{self.account}-{self.region}",
            encryption=s3.BucketEncryption.S3_MANAGED,
            enforce_ssl=True,
            versioned=True,
        )

        cdk.CfnOutput(
            self,
            "oS3AccessLogsBucketArn",
            export_name="oS3AccessLogsBucketArn",
            value=s3_access_logs_bucket.bucket_arn,
        )


class AntiVirusStack(cdk.Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        s3_access_logs_bucket = s3.Bucket.from_bucket_arn(
            self,
            "rS3AccessLogsBucket",
            bucket_arn=cdk.Fn.import_value("oS3AccessLogsBucketArn"),
        )

        ServerlessClamscan(
            self,
            "antivirus-scanning",
            defs_bucket_access_logs_config=ServerlessClamscanLoggingProps(
                logs_bucket=s3_access_logs_bucket,
                logs_prefix=f"s3-access-logs-{self.account}-{self.region}",
            ),
        )


app = cdk.App()
BucketStack(app, "BucketStack")
AntiVirusStack(app, "AntiVirusStack")

Aspects.of(app).add(AwsSolutionsChecks())
app.synth()
```


### What did you expect to happen?
I expected the cdk construct to accept an imported bucket being passed as a target for access logging for the Virus Definitions bucket

### cdk-serverless-clamscan version
2.1.26

### Language
Python

### Other information



Discussion / hints:
Thanks for reporting and submitting a PR 😄 
Thanks for reporting and submitting a PR 😄 

Fix patch:
diff --git a/API.md b/API.md
index 58546e8c..a95577a3 100644
--- a/API.md
+++ b/API.md
@@ -81,7 +81,7 @@ Name | Type | Description
 **errorDest** | <code>[aws_lambda.IDestination](#aws-cdk-lib-aws-lambda-idestination)</code> | The Lambda Destination for failed on erred scans [ERROR, IN PROGRESS (If error is due to Lambda timeout)].
 **resultDest** | <code>[aws_lambda.IDestination](#aws-cdk-lib-aws-lambda-idestination)</code> | The Lambda Destination for completed ClamAV scans [CLEAN, INFECTED].
 **cleanRule**? | <code>[aws_events.Rule](#aws-cdk-lib-aws-events-rule)</code> | Conditional: An Event Bridge Rule for files that are marked 'CLEAN' by ClamAV if a success destination was not specified.<br/>__*Optional*__
-**defsAccessLogsBucket**? | <code>[aws_s3.Bucket](#aws-cdk-lib-aws-s3-bucket)</code> | Conditional: The Bucket for access logs for the virus definitions bucket if logging is enabled (defsBucketAccessLogsConfig).<br/>__*Optional*__
+**defsAccessLogsBucket**? | <code>[aws_s3.IBucket](#aws-cdk-lib-aws-s3-ibucket)</code> | Conditional: The Bucket for access logs for the virus definitions bucket if logging is enabled (defsBucketAccessLogsConfig).<br/>__*Optional*__
 **errorDeadLetterQueue**? | <code>[aws_sqs.Queue](#aws-cdk-lib-aws-sqs-queue)</code> | Conditional: The SQS Dead Letter Queue for the errorQueue if a failure (onError) destination was not specified.<br/>__*Optional*__
 **errorQueue**? | <code>[aws_sqs.Queue](#aws-cdk-lib-aws-sqs-queue)</code> | Conditional: The SQS Queue for erred scans if a failure (onError) destination was not specified.<br/>__*Optional*__
 **infectedRule**? | <code>[aws_events.Rule](#aws-cdk-lib-aws-events-rule)</code> | Conditional: An Event Bridge Rule for files that are marked 'INFECTED' by ClamAV if a success destination was not specified.<br/>__*Optional*__
@@ -117,7 +117,7 @@ Interface for ServerlessClamscan Virus Definitions S3 Bucket Logging.
 
 Name | Type | Description 
 -----|------|-------------
-**logsBucket**? | <code>boolean &#124; [aws_s3.Bucket](#aws-cdk-lib-aws-s3-bucket)</code> | Destination bucket for the server access logs (Default: Creates a new S3 Bucket for access logs ).<br/>__*Optional*__
+**logsBucket**? | <code>boolean &#124; [aws_s3.IBucket](#aws-cdk-lib-aws-s3-ibucket)</code> | Destination bucket for the server access logs (Default: Creates a new S3 Bucket for access logs ).<br/>__*Optional*__
 **logsPrefix**? | <code>string</code> | Optional log file prefix to use for the bucket's access logs, option is ignored if logs_bucket is set to false.<br/>__*Optional*__
 
 
diff --git a/src/index.ts b/src/index.ts
index de72a1b9..f6890cd9 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -40,7 +40,7 @@ import {
   SqsDestination,
 } from 'aws-cdk-lib/aws-lambda-destinations';
 import { S3EventSource } from 'aws-cdk-lib/aws-lambda-event-sources';
-import { Bucket, BucketEncryption, EventType } from 'aws-cdk-lib/aws-s3';
+import { IBucket, Bucket, BucketEncryption, EventType } from 'aws-cdk-lib/aws-s3';
 import { Queue, QueueEncryption } from 'aws-cdk-lib/aws-sqs';
 import { NagSuppressions } from 'cdk-nag';
 import { Construct } from 'constructs';
@@ -52,7 +52,7 @@ export interface ServerlessClamscanLoggingProps {
   /**
    * Destination bucket for the server access logs (Default: Creates a new S3 Bucket for access logs ).
    */
-  readonly logsBucket?: boolean | Bucket;
+  readonly logsBucket?: boolean | IBucket;
   /**
    * Optional log file prefix to use for the bucket's access logs, option is ignored if logs_bucket is set to false.
    */
@@ -163,7 +163,7 @@ export class ServerlessClamscan extends Construct {
   /**
     Conditional: The Bucket for access logs for the virus definitions bucket if logging is enabled (defsBucketAccessLogsConfig).
    */
-  public readonly defsAccessLogsBucket?: Bucket;
+  public readonly defsAccessLogsBucket?: IBucket;
 
   private _scanFunction: DockerImageFunction;
   private _s3Gw: GatewayVpcEndpoint;


Test patch:
diff --git a/test/ServerlessClamscan.test.ts b/test/ServerlessClamscan.test.ts
index 32181007..58715b5c 100644
--- a/test/ServerlessClamscan.test.ts
+++ b/test/ServerlessClamscan.test.ts
@@ -134,6 +134,7 @@ test('expect VirusDefsBucket to use provided logs bucket', () => {
   new ServerlessClamscan(stack, 'default', {
     defsBucketAccessLogsConfig: { logsBucket: logs_bucket },
   });
+
   expect(stack).toHaveResourceLike('AWS::S3::Bucket', {
     LoggingConfiguration: {
       DestinationBucketName: {
@@ -155,6 +156,18 @@ test('expect VirusDefsBucket to use provided logs bucket', () => {
       LogFilePrefix: 'test',
     },
   });
+
+  const stack3 = new Stack();
+  new ServerlessClamscan(stack3, 'default', {
+    defsBucketAccessLogsConfig: {
+      logsBucket: Bucket.fromBucketName(stack3, 'rImportedLogsBucket', 'imported'),
+    },
+  });
+  expect(stack3).toHaveResourceLike('AWS::S3::Bucket', {
+    LoggingConfiguration: {
+      DestinationBucketName: 'imported',
+    },
+  });
 });
 
 test('expect VirusDefsBucket to not have access logging enabled', () => {