cfn_nag fails for CloudWatchLogs for KinesisStreamToS3

[knihit]

cfn_nag is enforcing rules for CloudWatchLog for retention period to be specified in days and supply a KMS key for encryption. The construct should add rules to suppress the following:

Reproduction Steps

Create a construct using

const firehoseToS3 = new KinesisFirehoseToS3(this, 'KinesisFirehose', {
    kinesisFirehoseProps: defaultKinesisFirehoseProps,
    existingBucketObj: props.s3Bucket
});

Error Log

| WARN W84
|
| Resources: []
| Line Numbers: []
|
| CloudWatchLogs LogGroup should specify a KMS Key Id to encrypt the log data

| WARN W86
|
| Resources: []
| Line Numbers: []
|
| CloudWatchLogs LogGroup should specify RetentionInDays to expire the log data

Environment

• **CDK CLI Version :1.85.0
• **CDK Framework Version:1.81.0
• **AWS Solutions Constructs Version :1.81.0
• **OS :MacOS
• **Language :Typscript

Other

---

This is 🐛 Bug Report

[knihit]

As a workaround, I am adding the following code to suppress cfn_nag.

  (firehoseToS3.node.findChild('firehose-log-group').node.defaultChild as CfnLogGroup).cfnOptions.metadata = {
      cfn_nag: {
          rules_to_suppress: [{
              id: 'W84',
              reason: 'Log group data is always encrypted in CloudWatch Logs using AWS Managed KMS Key. For customers wanting to us CMK for \
              CloudWatchLogs should customize the solution further to add encryption options'
          }, {
              id: 'W86',
              reason: 'Log Groups are set to \'Never Expire\'. Customers should customize the retention policy based on their organization\'s \
              retention policies'
          }]
      }
  }

[hnishar]

Fix for this has been pushed out in the latest release v1.82.0