Skip to content

Commit 0da7426

Browse files
committed
chore: update v2-main to main branch cdklabs#814
1 parent 0183f52 commit 0da7426

19 files changed

+44
-99
lines changed

.gitattributes

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

.github/workflows/release.yml

+3-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

.github/workflows/upgrade-v2-main.yml .github/workflows/upgrade-main.yml

+6-6
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

.gitignore

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

.projen/files.json

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

.projen/tasks.json

+3-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

.projenrc.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ const project = new awscdk.AwsCdkConstructLibrary({
77
author: 'Arun Donti',
88
authorAddress: '[email protected]',
99
cdkVersion: '2.11.0',
10-
defaultReleaseBranch: 'v2-main',
10+
defaultReleaseBranch: 'main',
1111
majorVersion: 2,
1212
npmDistTag: 'latest',
1313
name: 'cdk-nag',

README.md

+13-53
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,14 @@ SPDX-License-Identifier: Apache-2.0
55

66
# cdk-nag
77

8-
| Language | cdk-nag | monocdk-nag |
9-
| ---------- | ------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
10-
| Python | [![PyPI version](https://img.shields.io/pypi/v/cdk-nag)](https://pypi.org/project/cdk-nag/) | [![PyPI version](https://img.shields.io/pypi/v/monocdk-nag)](https://pypi.org/project/monocdk-nag/) |
11-
| TypeScript | [![npm version](https://img.shields.io/npm/v/cdk-nag)](https://www.npmjs.com/package/cdk-nag) | [![npm version](https://img.shields.io/npm/v/monocdk-nag/latest-1?label=npm)](https://www.npmjs.com/package/monocdk-nag) |
12-
| Java | [![Maven version](https://img.shields.io/maven-central/v/io.github.cdklabs/cdknag)](https://search.maven.org/search?q=a:cdknag) | [![Maven version](https://img.shields.io/maven-central/v/io.github.cdklabs/monocdknag)](https://search.maven.org/search?q=a:monocdknag) |
13-
| .NET | [![NuGet version](https://img.shields.io/nuget/v/Cdklabs.CdkNag)](https://www.nuget.org/packages/Cdklabs.CdkNag) | [![NuGet version](https://img.shields.io/nuget/v/Cdklabs.MonocdkNag)](https://www.nuget.org/packages/Cdklabs.MonocdkNag) |
8+
[![PyPI version](https://img.shields.io/pypi/v/cdk-nag)](https://pypi.org/project/cdk-nag/)
9+
[![npm version](https://img.shields.io/npm/v/cdk-nag)](https://www.npmjs.com/package/cdk-nag)
10+
[![Maven version](https://img.shields.io/maven-central/v/io.github.cdklabs/cdknag)](https://search.maven.org/search?q=a:cdknag)
11+
[![NuGet version](https://img.shields.io/nuget/v/Cdklabs.CdkNag)](https://www.nuget.org/packages/Cdklabs.CdkNag)
1412

15-
- If your project uses cdk version **1.x.x** use `cdk-nag` **^1.0.0**
16-
- If your project uses cdk version **2.x.x** use `cdk-nag` **^2.0.0**
17-
- If your project uses monocdk use `monocdk-nag` **^1.0.0**
13+
Check CDK applications or [CloudFormation templates](#using-on-cloudformation-templates) for best practices using a combination of available rule packs. Inspired by [cfn_nag](https://github.com/stelligent/cfn_nag).
1814

19-
Check CDK applications or [CloudFormation templates](#using-on-cloudformation-templates) for best practices using a combination of available rule packs. Inspired by [cfn_nag](https://github.com/stelligent/cfn_nag)
15+
Check out [this blog post](https://aws.amazon.com/blogs/devops/manage-application-security-and-compliance-with-the-aws-cloud-development-kit-and-cdk-nag/) for a guided overview!
2016

2117
![](cdk_nag.gif)
2218

@@ -37,7 +33,7 @@ Read the [NagPack developer docs](./docs/NagPack.md) if you are interested in cr
3733
For a full list of options See `NagPackProps` in the [API.md](./API.md#struct-nagpackprops)
3834

3935
<details>
40-
<summary>cdk</summary>
36+
<summary>Including in an application</summary>
4137

4238
```typescript
4339
import { App, Aspects } from 'aws-cdk-lib';
@@ -54,42 +50,6 @@ Aspects.of(app).add(new AwsSolutionsChecks());
5450

5551
</details>
5652

57-
<details>
58-
<summary>cdk v2</summary>
59-
60-
```typescript
61-
import { App, Aspects } from 'aws-cdk-lib';
62-
import { CdkTestStack } from '../lib/cdk-test-stack';
63-
import { AwsSolutionsChecks } from 'cdk-nag';
64-
65-
const app = new App();
66-
new CdkTestStack(app, 'CdkNagDemo');
67-
// Simple rule informational messages
68-
Aspects.of(app).add(new AwsSolutionsChecks());
69-
// Additional explanations on the purpose of triggered rules
70-
// Aspects.of(stack).add(new AwsSolutionsChecks({ verbose: true }));
71-
```
72-
73-
</details>
74-
75-
<details>
76-
<summary>monocdk</summary>
77-
78-
```typescript
79-
import { App, Aspects } from 'monocdk';
80-
import { CdkTestStack } from '../lib/my-stack';
81-
import { AwsSolutionsChecks } from 'monocdk-nag';
82-
83-
const app = new App();
84-
new CdkTestStack(app, 'CdkNagDemo');
85-
// Simple rule informational messages
86-
Aspects.of(app).add(new AwsSolutionsChecks());
87-
// Additional explanations on the purpose of triggered rules
88-
// Aspects.of(stack).add(new AwsSolutionsChecks({ verbose: true }));
89-
```
90-
91-
</details>
92-
9353
## Suppressing a Rule
9454

9555
<details>
@@ -212,10 +172,10 @@ export class CdkTestStack extends Stack {
212172
Certain rules support granular suppressions of `findings`. If you received the following errors on synth/deploy
213173

214174
```bash
215-
[Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Action::s3:*]: The IAM entity contains wildcard permissions and does not have a cdk_nag rule suppression with evidence for those permission.
216-
[Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk_nag rule suppression with evidence for those permission.
217-
[Error at /StackName/rSecondUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Action::s3:*]: The IAM entity contains wildcard permissions and does not have a cdk_nag rule suppression with evidence for those permission.
218-
[Error at /StackName/rSecondUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk_nag rule suppression with evidence for those permission.
175+
[Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Action::s3:*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
176+
[Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
177+
[Error at /StackName/rSecondUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Action::s3:*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
178+
[Error at /StackName/rSecondUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
219179
```
220180

221181
By applying the following suppressions
@@ -294,14 +254,14 @@ export class CdkTestStack extends Stack {
294254
You would see the following error on synth/deploy
295255

296256
```bash
297-
[Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk_nag rule suppression with evidence for those permission.
257+
[Error at /StackName/rFirstUser/DefaultPolicy/Resource] AwsSolutions-IAM5[Resource::*]: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.
298258
```
299259

300260
</details>
301261

302262
## Rules and Property Overrides
303263

304-
In some cases L2 Constructs do not have a native option to remediate an issue and must be fixed via [Raw Overrides](https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html#cfn_layer_raw). Since raw overrides take place after template synthesis these fixes are not caught by the cdk_nag. In this case you should remediate the issue and suppress the issue like in the following example.
264+
In some cases L2 Constructs do not have a native option to remediate an issue and must be fixed via [Raw Overrides](https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html#cfn_layer_raw). Since raw overrides take place after template synthesis these fixes are not caught by cdk-nag. In this case you should remediate the issue and suppress the issue like in the following example.
305265

306266
<details>
307267
<summary>Example) Property Overrides</summary>

0 commit comments

Comments
 (0)