Add suppression for the new prompt wildcard permission

kris-szlapa · kris-szlapa · commit d9c00a3071e3 · 2025-08-22T19:30:31.000Z
diff --git a/packages/cdk/nagSuppressions.ts b/packages/cdk/nagSuppressions.ts
@@ -149,6 +149,7 @@ export const nagSuppressions = (stack: Stack) => {
         appliesTo: [
           `Resource::arn:aws:lambda:eu-west-2:${account}:function:*`,
           `Resource::arn:aws:bedrock:eu-west-2:${account}:prompt/*`,
+          `Resource::arn:aws:bedrock:eu-west-2:${account}:prompt/${stackName}-queryReformulation:*`,
           "Action::kms:GenerateDataKey*",
           "Action::kms:ReEncrypt*"
         ]

Original file line number	Diff line number	Diff line change
`@@ -149,6 +149,7 @@ export const nagSuppressions = (stack: Stack) => {`
`149`	`149`	`appliesTo: [`
`150`	`150`	`Resource::arn:aws:lambda:eu-west-2:${account}:function:*`,
`151`	`151`	`Resource::arn:aws:bedrock:eu-west-2:${account}:prompt/*`,
	`152`	+ `Resource::arn:aws:bedrock:eu-west-2:${account}:prompt/${stackName}-queryReformulation:*`,
`152`	`153`	`"Action::kms:GenerateDataKey*",`
`153`	`154`	`"Action::kms:ReEncrypt*"`
`154`	`155`	`]`