Skip to content

Commit aa1b7e5

Browse files
curtismscurtisms
authored
Merge pull request #1536 from aws-samples/dependabot/maven/labs/unicorn-store/infrastructure/cdk/io.github.cdklabs-cdknag-3.0.1
Bump io.github.cdklabs:cdknag from 2.38.2 to 3.0.1 in /labs/unicorn-store/infrastructure/cdk
2 parents 0d80759 + 288df2c commit aa1b7e5

2 files changed

Lines changed: 41 additions & 41 deletions

File tree

‎labs/unicorn-store/infrastructure/cdk/pom.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<properties>
1111
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1212
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
13-
<cdk.version>2.257.0</cdk.version>
13+
<cdk.version>2.261.0</cdk.version>
1414
<junit.version>6.1.0</junit.version>
1515
</properties>
1616

@@ -21,8 +21,8 @@
2121
<artifactId>maven-compiler-plugin</artifactId>
2222
<version>3.15.0</version>
2323
<configuration>
24-
<source>17</source>
25-
<target>17</target>
24+
<source>25</source>
25+
<target>25</target>
2626
</configuration>
2727
</plugin>
2828

@@ -48,7 +48,7 @@
4848
<dependency>
4949
<groupId>io.github.cdklabs</groupId>
5050
<artifactId>cdknag</artifactId>
51-
<version>2.38.2</version>
51+
<version>3.0.1</version>
5252
</dependency>
5353

5454
<dependency>

‎labs/unicorn-store/infrastructure/cdk/src/main/java/com/unicorn/UnicornStoreApp.java‎

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package com.unicorn;
22

3-
import java.util.List;
3+
import java.util.HashMap;
44

55
import com.unicorn.alternatives.UnicornAuditService;
66
import com.unicorn.alternatives.UnicornStoreMicronaut;
@@ -9,11 +9,8 @@
99
import com.unicorn.core.InfrastructureStack;
1010

1111
import io.github.cdklabs.cdknag.AwsSolutionsChecks;
12-
import io.github.cdklabs.cdknag.NagPackSuppression;
13-
import io.github.cdklabs.cdknag.NagSuppressions;
14-
import software.amazon.awscdk.App;
15-
import software.amazon.awscdk.Aspects;
16-
import software.amazon.awscdk.StackProps;
12+
import io.github.cdklabs.cdknag.NagPackProps;
13+
import software.amazon.awscdk.*;
1714

1815
public class UnicornStoreApp {
1916

@@ -23,51 +20,54 @@ public static void main(final String[] args) {
2320
var infrastructureStack = new InfrastructureStack(app, "UnicornStoreInfrastructure", StackProps.builder()
2421
.build());
2522

26-
var unicornStoreSpring = new UnicornStoreStack(app, "UnicornStoreSpringApp", StackProps.builder()
23+
new UnicornStoreStack(app, "UnicornStoreSpringApp", StackProps.builder()
2724
.build(), infrastructureStack);
2825

29-
var unicornStoreMicronaut = new UnicornStoreMicronaut(app, "UnicornStoreMicronautApp", StackProps.builder()
26+
new UnicornStoreMicronaut(app, "UnicornStoreMicronautApp", StackProps.builder()
3027
.build(), infrastructureStack);
3128

32-
var unicornStoreSpringGraalVM = new UnicornStoreSpringGraalVM(app, "UnicornStoreSpringGraalVMApp", StackProps.builder()
29+
new UnicornStoreSpringGraalVM(app, "UnicornStoreSpringGraalVMApp", StackProps.builder()
3330
.build(), infrastructureStack);
3431

35-
var unicornStoreQuarkus = new UnicornStoreQuarkus(app, "UnicornStoreQuarkusApp", StackProps.builder()
32+
new UnicornStoreQuarkus(app, "UnicornStoreQuarkusApp", StackProps.builder()
3633
.build(), infrastructureStack);
3734

38-
var unicornAuditService = new UnicornAuditService(app, "UnicornAuditServiceApp", StackProps.builder()
35+
new UnicornAuditService(app, "UnicornAuditServiceApp", StackProps.builder()
3936
.build(), infrastructureStack);
4037

41-
4238
//Add CDK-NAG checks: https://github.com/cdklabs/cdk-nag
39+
Validations.of(app).addPlugins(new AwsSolutionsChecks(app,
40+
NagPackProps.builder().writeSuppressionsToCloudFormation(true).build()));
41+
4342
//Add suppression to exclude certain findings that are not needed for Workshop environment
44-
Aspects.of(app).add(new AwsSolutionsChecks());
45-
var suppression = List.of(
46-
new NagPackSuppression.Builder().id("AwsSolutions-APIG4").reason("The workshop environment does not require API-Gateway authorization").build(),
47-
new NagPackSuppression.Builder().id("AwsSolutions-COG4").reason("The workshop environment does not require Cognito User Pool authorization").build(),
48-
new NagPackSuppression.Builder().id("AwsSolutions-RDS3").reason("Workshop environment does not need a Multi-AZ setup to reduce cost").build(),
49-
new NagPackSuppression.Builder().id("AwsSolutions-IAM4").reason("AWS Managed policies are acceptable for the workshop").build(),
50-
new NagPackSuppression.Builder().id("AwsSolutions-IAM5").reason("A wildcard is acceptable for this workshop to allow parallel creation of resources").build(),
51-
new NagPackSuppression.Builder().id("AwsSolutions-RDS10").reason("Workshop environment is ephemeral and the database should be deleted by the end of the workshop").build(),
52-
new NagPackSuppression.Builder().id("AwsSolutions-RDS11").reason("Database is in a private subnet and can use the default port").build(),
53-
new NagPackSuppression.Builder().id("AwsSolutions-APIG2").reason("API Gateway request validation is not needed for workshop").build(),
54-
new NagPackSuppression.Builder().id("AwsSolutions-APIG1").reason("API Gateway access logging not needed for workshop setup").build(),
55-
new NagPackSuppression.Builder().id("AwsSolutions-APIG6").reason("API Gateway access logging not needed for workshop setup").build(),
56-
new NagPackSuppression.Builder().id("AwsSolutions-VPC7").reason("Workshop environment does not need VPC flow logs").build(),
57-
new NagPackSuppression.Builder().id("AwsSolutions-SMG4").reason("Ephemeral workshop environment does not need to rotate secrets").build(),
58-
new NagPackSuppression.Builder().id("AwsSolutions-RDS2").reason("Workshop non-sensitive test database does not need encryption at rest").build(),
59-
new NagPackSuppression.Builder().id("AwsSolutions-APIG3").reason("Workshop API Gateways do not need AWS WAF assigned").build(),
60-
new NagPackSuppression.Builder().id("AwsSolutions-EC23").reason("Not needed").build(),
61-
new NagPackSuppression.Builder().id("AwsSolutions-RDS13").reason("Workshop Database does not need backups").build(),
62-
new NagPackSuppression.Builder().id("CdkNagValidationFailure").reason("Suppress warnings see: https://github.com/cdklabs/cdk-nag/issues/817").build()
43+
Validations.of(app).acknowledge(
44+
new Acknowledgment.Builder().id("AwsSolutions-APIG4").reason("The workshop environment does not require API-Gateway authorization").build(),
45+
new Acknowledgment.Builder().id("AwsSolutions-COG4").reason("The workshop environment does not require Cognito User Pool authorization").build(),
46+
new Acknowledgment.Builder().id("AwsSolutions-RDS3").reason("Workshop environment does not need a Multi-AZ setup to reduce cost").build(),
47+
new Acknowledgment.Builder().id("AwsSolutions-RDS10").reason("Workshop environment is ephemeral and the database should be deleted by the end of the workshop").build(),
48+
new Acknowledgment.Builder().id("AwsSolutions-RDS11").reason("Database is in a private subnet and can use the default port").build(),
49+
new Acknowledgment.Builder().id("AwsSolutions-APIG2").reason("API Gateway request validation is not needed for workshop").build(),
50+
new Acknowledgment.Builder().id("AwsSolutions-APIG1").reason("API Gateway access logging not needed for workshop setup").build(),
51+
new Acknowledgment.Builder().id("AwsSolutions-APIG6").reason("API Gateway access logging not needed for workshop setup").build(),
52+
new Acknowledgment.Builder().id("AwsSolutions-VPC7").reason("Workshop environment does not need VPC flow logs").build(),
53+
new Acknowledgment.Builder().id("AwsSolutions-SMG4").reason("Ephemeral workshop environment does not need to rotate secrets").build(),
54+
new Acknowledgment.Builder().id("AwsSolutions-RDS2").reason("Workshop non-sensitive test database does not need encryption at rest").build(),
55+
new Acknowledgment.Builder().id("AwsSolutions-APIG3").reason("Workshop API Gateways do not need AWS WAF assigned").build(),
56+
new Acknowledgment.Builder().id("AwsSolutions-EC23").reason("Not needed").build(),
57+
new Acknowledgment.Builder().id("AwsSolutions-RDS13").reason("Workshop Database does not need backups").build(),
58+
new Acknowledgment.Builder().id("CdkNagValidationFailure").reason("Suppress warnings see: https://github.com/cdklabs/cdk-nag/issues/817").build()
6359
);
6460

65-
NagSuppressions.addStackSuppressions(infrastructureStack, suppression);
66-
NagSuppressions.addStackSuppressions(unicornStoreSpring, suppression);
67-
NagSuppressions.addStackSuppressions(unicornStoreMicronaut, suppression);
68-
NagSuppressions.addStackSuppressions(unicornStoreSpringGraalVM, suppression);
69-
NagSuppressions.addStackSuppressions(unicornStoreQuarkus, suppression);
70-
NagSuppressions.addStackSuppressions(unicornAuditService, suppression);
61+
// Suppress parameterized IAM findings directly via metadata
62+
// (Validations.acknowledge() rejects IDs containing '::' due to CDK delimiter validation bug)
63+
var iamSuppressions = new HashMap<String, String>();
64+
iamSuppressions.put("AwsSolutions-IAM4", "AWS Managed policies are acceptable for the workshop");
65+
iamSuppressions.put("AwsSolutions-IAM5", "A wildcard is acceptable for this workshop to allow parallel creation of resources");
66+
iamSuppressions.put("AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]", "AWS Managed policies are acceptable for the workshop");
67+
iamSuppressions.put("AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole]", "AWS Managed policies are acceptable for the workshop");
68+
iamSuppressions.put("AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs]", "AWS Managed policies are acceptable for the workshop");
69+
iamSuppressions.put("AwsSolutions-IAM5[Resource::arn:aws:secretsmanager:*:*:secret:unicornstore-db-secret-*]", "A wildcard is acceptable for this workshop");
70+
app.getNode().addMetadata(Validations.ACKNOWLEDGED_RULES_METADATA_KEY, iamSuppressions);
7171

7272
app.synth();
7373
}

0 commit comments

Comments
 (0)