From e54bd14527d5b1004577311f97f0a53429709a71 Mon Sep 17 00:00:00 2001
From: Toni de la Fuente <toni@blyx.com>
Date: Fri, 14 Jan 2022 12:50:06 +0100
Subject: [PATCH] Fix: issue #741 CloudFront and real-time logs

---
 checks/check_extra714 | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/checks/check_extra714 b/checks/check_extra714
index 40d2c67939..9408fa6d1e 100644
--- a/checks/check_extra714
+++ b/checks/check_extra714
@@ -28,8 +28,9 @@ extra714(){
   LIST_OF_DISTRIBUTIONS=$($AWSCLI cloudfront list-distributions $PROFILE_OPT --query 'DistributionList.Items[].Id' --output text | grep -v "^None")
   if [[ $LIST_OF_DISTRIBUTIONS ]]; then
     for dist in $LIST_OF_DISTRIBUTIONS; do
-      LOG_ENABLED=$($AWSCLI cloudfront get-distribution $PROFILE_OPT --id "$dist" --query 'Distribution.DistributionConfig.Logging.Enabled' | grep true)
-      if [[ $LOG_ENABLED ]]; then
+      LOG_ENABLED=$($AWSCLI cloudfront get-distribution $PROFILE_OPT --id "$dist" --query 'Distribution.DistributionConfig.Logging.Enabled' --output text | grep True)
+      LOG_ENABLED_REALTIME=$($AWSCLI cloudfront get-distribution $PROFILE_OPT --id "$dist" --query 'Distribution.DistributionConfig.DefaultCacheBehavior.RealtimeLogConfigArn' --output text | grep -i arn)
+      if [[ $LOG_ENABLED || $LOG_ENABLED_REALTIME ]]; then
         textPass "$REGION: CloudFront distribution $dist has logging enabled" "$REGION" "$dist"
       else
         textFail "$REGION: CloudFront distribution $dist has logging disabled" "$REGION" "$dist"