image-scanner-with-trivy/lib/scan-logs-output.d.ts

Scan container images with Trivy in CDK deployment

import { IGrantable } from 'aws-cdk-lib/aws-iam';
import { ILogGroup } from 'aws-cdk-lib/aws-logs';
import { IBucket } from 'aws-cdk-lib/aws-s3';
/**
 * Enum for ScanLogsOutputType
 */
export declare enum ScanLogsOutputType {
    /**
     * Output scan logs to CloudWatch Logs.
     */
    CLOUDWATCH_LOGS = "cloudWatchLogs",
    /**
     * Output scan logs to S3 bucket.
     */
    S3 = "s3"
}
/**
 * SBOM (Software Bill of Materials) output format for Trivy scans.
 */
export declare enum SbomFormat {
    /**
     * CycloneDX JSON format.
     */
    CYCLONEDX = "cyclonedx",
    /**
     * SPDX JSON format.
     */
    SPDX_JSON = "spdx-json",
    /**
     * SPDX Tag-Value format (human-readable).
     */
    SPDX = "spdx"
}
/**
 * Output configurations for scan logs.
 */
export interface ScanLogsOutputOptions {
    /**
     * The type of scan logs output.
     */
    readonly type: ScanLogsOutputType;
}
/**
 * Output configuration for scan logs to CloudWatch Logs.
 */
export interface CloudWatchLogsOutputOptions extends ScanLogsOutputOptions {
    /**
     * The name of the CloudWatch Logs log group.
     */
    readonly logGroupName: string;
}
/**
 * Configuration for scan logs output to CloudWatch Logs log group.
 */
export interface CloudWatchLogsOutputProps {
    /**
     * The log group to output scan logs.
     */
    readonly logGroup: ILogGroup;
}
/**
 * Output configuration for scan logs to S3 bucket.
 */
export interface S3OutputOptions extends ScanLogsOutputOptions {
    /**
     * The name of the S3 bucket.
     */
    readonly bucketName: string;
    /**
     * Optional prefix for S3 objects.
     */
    readonly prefix?: string;
    /**
     * Optional SBOM format to output in addition to scan logs.
     *
     * @default - No SBOM output
     */
    readonly sbomFormat?: SbomFormat;
}
/**
 * Configuration for scan logs output to S3 bucket.
 */
export interface S3OutputProps {
    /**
     * The S3 bucket to output scan logs.
     */
    readonly bucket: IBucket;
    /**
     * Optional prefix for S3 objects.
     */
    readonly prefix?: string;
    /**
     * Optional SBOM format to output in addition to scan logs.
     * When specified, SBOM will be generated and uploaded to S3.
     *
     * **Note**: SBOM generation is not a vulnerability scan. When this option is specified:
     * - Trivy generates a Software Bill of Materials (SBOM) instead of performing a vulnerability scan
     * - The scan will not fail regardless of the `failOnVulnerability` setting
     * - SNS notifications (`vulnsNotificationTopic`) will not be sent since no vulnerabilities are detected
     * - The SBOM file and stderr logs will be uploaded to S3
     *
     * @default - No SBOM output
     */
    readonly sbomFormat?: SbomFormat;
}
/**
 * Represents the output of the scan logs.
 */
export declare abstract class ScanLogsOutput {
    /**
     * Scan logs output to CloudWatch Logs log group.
     *
     * **Note on Large Scan Results**: CloudWatch Logs has a limit of 1 MB per log event.
     * If Trivy scan results exceed this limit, they will be automatically
     * split into multiple log events. Each chunk will be prefixed with `[part X/Y]` to
     * indicate the sequence, ensuring no data loss while staying within CloudWatch Logs quotas.
     * **For large scan results, we recommend using S3 output instead** to avoid fragmentation
     * and make it easier to view complete results.
     */
    static cloudWatchLogs(options: CloudWatchLogsOutputProps): ScanLogsOutput;
    /**
     * Scan logs output to S3 bucket.
     */
    static s3(options: S3OutputProps): ScanLogsOutput;
    /**
     * Returns the output configuration for scan logs.
     */
    abstract bind(grantee: IGrantable): ScanLogsOutputOptions;
}