Repository: awslabs/cdk-serverless-clamscan (language: python)

Issue:
Disable Access Logs?
Hi is there a way to disable access logs from writing to a bucket? I noticed that there are a lot of logs generated over time and I was wondering if there was a way to make it optional. 

Also, what kind of data is being stored in here?

Thank you in advance! 


Discussion / hints:
Also, I noticed, after deleting the cfn stack the access log bucket is still there and has new logs. Is that the expected behavior? 
>Hi is there a way to disable access logs from writing to a bucket? I noticed that there are a lot of logs generated over time and I was wondering if there was a way to make it optional.

You can [use this property to disable access logging](https://constructs.dev/packages/cdk-serverless-clamscan/v/2.4.62/api/ServerlessClamscanProps?lang=typescript#property.defsBucketAccessLogsConfig).

> Also, what kind of data is being stored in here?

Data related to who/what is accessing the s3 bucket that contains the virus scan definitions

> Also, I noticed, after deleting the cfn stack the access log bucket is still there and has new logs. Is that the expected behavior?

Hmm, this may be because the access log bucket is [logging to itself](https://github.com/awslabs/cdk-serverless-clamscan/blob/eb9bb22df7c58fcadbb0f40cf398c04d815696fb/src/index.ts#L302) causing an infinite logging loop. This  isn't the intended behavior and I don't really see a reason to have the logging bucket lg to itself
> Hmm, this may be because the access log bucket is [logging to itself](https://github.com/awslabs/cdk-serverless-clamscan/blob/eb9bb22df7c58fcadbb0f40cf398c04d815696fb/src/index.ts#L302) causing an infinite logging loop. This isn't the intended behavior and I don't really see a reason to have the logging bucket lg to itself

This confirms what I have seen so far, is there a way to go around this or maybe have the logging bucket also be deleted when the stack is deleted? 
The logs are there for those who need them for auditing purposes. It doesn't make sense to remove it by default.

In this case you can empty and delete the bucket after the fact
I see thank you! Hmm but does there happen to be a way around the infinite loop?
I think it would be reasonable to have a PR to make it so that the default access log bucket doesn't log to itself or any other bucket
If nobody has objections, I am going to open a PR to disable these access logs, on the logs bucket

Fix patch:
diff --git a/src/index.ts b/src/index.ts
index 45134d37..16edf180 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -299,7 +299,6 @@ export class ServerlessClamscan extends Construct {
         {
           encryption: BucketEncryption.S3_MANAGED,
           removalPolicy: RemovalPolicy.RETAIN,
-          serverAccessLogsPrefix: 'access-logs-bucket-logs',
           blockPublicAccess: {
             blockPublicAcls: true,
             blockPublicPolicy: true,


Test patch:
diff --git a/test/CdkNag.test.ts b/test/CdkNag.test.ts
index 277f948b..4717bdc9 100644
--- a/test/CdkNag.test.ts
+++ b/test/CdkNag.test.ts
@@ -39,6 +39,12 @@ test('expect default configuration to pass cdk-nag AwsSolutions checks', () => {
   true,
   );
 
+  NagSuppressions.addResourceSuppressionsByPath(stack, '/Default/default/VirusDefsAccessLogsBucket/Resource', [
+    { id: 'AwsSolutions-S1', reason: 'The bucket is used as an access log destination. Enabling access logs would cause an infinite loop.' },
+  ],
+  true,
+  );
+
   const messages = SynthUtils.synthesize(stack).messages;
   expect(messages).not.toContainEqual(
     expect.objectContaining({