chore: new github action to run security-guardian #34115

QuantumNeuralCoder · 2025-04-11T20:06:47Z

Issue # (if applicable)

None

Closes #.
None

Reason for this change

Adds a new tool to run cfn-guard
Enhances PR linter to find added or updated snapshot templates and run cfn-guard through them for detecting inline broad trust policy

Description of changes

Refer README.md

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Tested on personal fork. Refer QuantumNeuralCoder#6
PR Linter output shows test results.

Checklist

[ x] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

codecov · 2025-04-11T20:16:07Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.00%. Comparing base (74cbe27) to head (b52d3d3).
Report is 35 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #34115      +/-   ##
==========================================
+ Coverage   83.98%   84.00%   +0.01%     
==========================================
  Files         120      121       +1     
  Lines        6976     6984       +8     
  Branches     1178     1179       +1     
==========================================
+ Hits         5859     5867       +8     
  Misses       1005     1005              
  Partials      112      112

Flag	Coverage Δ
suite.unit	`84.00% <ø> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`84.00% <ø> (+0.01%)`	⬆️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Separating github action from the tool

QuantumNeuralCoder · 2025-04-11T22:52:38Z

Exemption Request since github workflow separately tested on personal fork.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

moelasmar · 2025-04-11T23:08:35Z

tools/@aws-cdk/cfn-guard-custom-rules-tool/action.yml

+    required: false
+    default: "single-line-summary"
+
+runs:


since cfn-guard is required, I believe it worth adding a step to install cfn-guard, so we do not need every time we use this GH action to add a step to install it

tools/@aws-cdk/cfn-guard-custom-rules-tool/action.yml

moelasmar · 2025-04-11T23:13:41Z

tools/@aws-cdk/cfn-guard-custom-rules-tool/src/index.ts

+    if (!rulePathToUse && ruleSetUrl) {
+      const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'rules-'));
+      rulePathToUse = path.join(tempDir, 'rules.guard');
+      await downloadFile(ruleSetUrl, rulePathToUse);
+    }


I think the rules set file will be always a local file in the repo, why shall we download it ?

Addressed all in latest commit

moelasmar · 2025-04-14T19:11:39Z

.github/workflows/security-guardian.yml

+  # Triggered from a separate job when a review is added
+  workflow_run:
+    workflows: [PR Linter Trigger]
+    types:
+      - completed


not really following, based on lines 2,3

on: pull_request: {}

This action will be invoked whenever the PR got created, synchronized, reopened, updated. So, why we still need to link this action to another flow, what will be the added value

moelasmar · 2025-04-14T19:12:48Z

.github/workflows/security-guardian.yml

+    permissions:
+      contents: read
+      pull-requests: read
+      statuses: read
+      issues: read
+      checks: read


at least from my understanding, I do not see that this action do any updates to the PR, so why do we need these permissions. Also, I think the comment on line 20 is not aligning withe the given permissions, since all permissions are read

.github/workflows/security-guardian.yml

moelasmar · 2025-04-14T19:19:18Z

tools/@aws-cdk/security-guardian/README.md

+# Security Guardian
+
+A GitHub Action tool designed to validate changed AWS CloudFormation templates against custom [cfn-guard](https://github.com/aws-cloudformation/cloudformation-guard) rules. Supports both local paths and remote URLs for rule sets.


I think this tool is planned to do more checks than running cfn-guard. As I understood, for now it will run cfn-guard against one rule, with a plan to extend these rules.
Also, there is some static check logic is planned to be done on the snapshot templates, that will be done in the tool, and not by cfn-guard.

If my understanding is not correct, so I think we do not need to implement this tool in TS, it can be as simple as running a bash script.

tools/@aws-cdk/security-guardian/README.md

…es): .git

moelasmar · 2025-04-14T22:24:44Z

.github/workflows/security-guardian.yml

+    permissions:
+        contents: read
+        pages: write
+        id-token: write


why we these permissions are needed ?

For codecov for this PR. On side note, pull_request_target will run in main branch context. We can only see the gh action once its merged.

moelasmar

Thanks Indranil. I am approving the PR, but as we agreed, we need a follow up PR to allow contributors to execute the security guardian tool locally.

mergify · 2025-04-15T05:00:35Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-04-15T05:32:15Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: effd556
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-04-15T05:32:36Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-04-15T05:32:51Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

feat(cfn-guard-action): Adding cfn guard run to pr linter

d2a8dac

aws-cdk-automation requested a review from a team April 11, 2025 20:06

github-actions bot added the p2 label Apr 11, 2025

QuantumNeuralCoder added pr/do-not-merge This PR should not be merged at this time. and removed p2 labels Apr 11, 2025

mergify bot added the contribution/core This is a PR that came from AWS. label Apr 11, 2025

aws-cdk-automation previously requested changes Apr 11, 2025

View reviewed changes

QuantumNeuralCoder added 5 commits April 11, 2025 14:15

feat(cfn-guard-action): Testing PR files changed testcase

a92e50c

feat(cfn-guard-action): Testing action

e3bbb21

feat(cfn-guard-action): Correcting input validation

cedaa29

feat(cfn-guard-action): test

52656dd

feat(cfn-guard-action): test

9467c57

Separating github action from the tool

QuantumNeuralCoder force-pushed the cfn-guard-action branch from 733b2ef to 9467c57 Compare April 11, 2025 22:38

QuantumNeuralCoder changed the title ~~feat(cfn-guard-action): Adding cfn guard run to pr linter~~ feat(cfn-guard-action): new tool to run cfn-guard to detect inline broad scoped permissions Apr 11, 2025

github-actions bot added the p2 label Apr 11, 2025

adding ReadMe

db2fa71

aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Apr 11, 2025

QuantumNeuralCoder requested a review from moelasmar April 11, 2025 22:53

QuantumNeuralCoder removed the pr/do-not-merge This PR should not be merged at this time. label Apr 11, 2025

QuantumNeuralCoder changed the title ~~feat(cfn-guard-action): new tool to run cfn-guard to detect inline broad scoped permissions~~ chore: new tool to run cfn-guard to detect inline broad scoped permissions Apr 11, 2025

QuantumNeuralCoder mentioned this pull request Apr 11, 2025

chore: cfn-guard action added to pr-linter #34118

Closed

moelasmar reviewed Apr 11, 2025

View reviewed changes

tools/@aws-cdk/cfn-guard-custom-rules-tool/action.yml Outdated Show resolved Hide resolved

moelasmar reviewed Apr 11, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Apr 11, 2025

QuantumNeuralCoder added 2 commits April 11, 2025 17:11

adding security guardian tool

9ab2a88

adding security guardian tool

2c1516e

QuantumNeuralCoder added 5 commits April 14, 2025 11:22

fetching full history since it failed in test with bad object

a8021a9

Removing unwanted integ files. Adding a test file.

80f41e3

test2 - s-g

4737586

modifying s-g action to minimize to required jobs

db4f8ca

test s-g action

b52d3d3

QuantumNeuralCoder force-pushed the cfn-guard-action branch from 76b0552 to b52d3d3 Compare April 14, 2025 18:25

moelasmar reviewed Apr 14, 2025

View reviewed changes

QuantumNeuralCoder added 10 commits April 14, 2025 13:03

clarifying documentation, license and removing workflow run dependency

cf0ddb7

clarifying documentation, license and removing workflow run dependency

2c51d10

Removing checkout@v4

d29abc9

Emojis everywhere. Thanks QCli

4dc17c9

Formatting readme

c3edcd0

Resolving fatal: not a git repository (or any of the parent directori…

47e230a

…es): .git

Removing action.yml since this is not planned standalone

e47ce0a

Adding action.yml required by cfn-guard

b4e9d8d

Resolving codecov upload issue

ea70076

Resolving codecov upload issue

dde70db

moelasmar reviewed Apr 14, 2025

View reviewed changes

QuantumNeuralCoder added 2 commits April 14, 2025 15:40

on pull_request_target for broader access

55ba67a

Merge branch 'main' into cfn-guard-action

4fdcea4

QuantumNeuralCoder changed the title ~~chore: new tool to run cfn-guard to detect inline broad scoped permissions~~ chore: new github action to run security-guardian Apr 14, 2025

moelasmar approved these changes Apr 15, 2025

View reviewed changes

Merge branch 'main' into cfn-guard-action

effd556

mergify bot merged commit beb42fd into aws:main Apr 15, 2025
13 of 14 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Apr 15, 2025

QuantumNeuralCoder deleted the cfn-guard-action branch May 14, 2025 21:18

		# Security Guardian

		A GitHub Action tool designed to validate changed AWS CloudFormation templates against custom [cfn-guard](https://github.com/aws-cloudformation/cloudformation-guard) rules. Supports both local paths and remote URLs for rule sets.

chore: new github action to run security-guardian #34115

chore: new github action to run security-guardian #34115

Uh oh!

Conversation

QuantumNeuralCoder commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

QuantumNeuralCoder commented Apr 11, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

moelasmar left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Apr 15, 2025

Uh oh!

aws-cdk-automation commented Apr 15, 2025

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Apr 15, 2025

Uh oh!

Uh oh!

github-actions bot commented Apr 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

QuantumNeuralCoder commented Apr 11, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Apr 11, 2025 •

edited

Loading