Skip to content

Commit 2cd2323

Browse files
OrkastratedOrkastrated
committed
[AEA-4684] resolving cfn-guard issues
1 parent 18cea94 commit 2cd2323

File tree

6 files changed

+148
-6
lines changed

6 files changed

+148
-6
lines changed

‎.github/workflows/cdk_release_code.yml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,12 +85,10 @@ jobs:
8585
--arg VERSION_NUMBER "${{ inputs.VERSION_NUMBER }}" \
8686
--arg COMMIT_ID "${{ inputs.COMMIT_ID }}" \
8787
--arg logRetentionInDays "${{ inputs.LOG_RETENTION_IN_DAYS }}" \
88-
--argjson allowAutoDeleteObjects "true" \
8988
'.context += {
9089
"VERSION_NUMBER": $VERSION_NUMBER,
9190
"COMMIT_ID": $COMMIT_ID,
92-
"logRetentionInDays": $logRetentionInDays,
93-
"allowAutoDeleteObjects": $allowAutoDeleteObjects}' \
91+
"logRetentionInDays": $logRetentionInDays}' \
9492
.build/cdk.json > .build/cdk.new.json
9593
mv .build/cdk.new.json .build/cdk.json
9694

‎Makefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ cdk-synth:
8282
--app "npx ts-node --prefer-ts-exts packages/cdk/bin/VpcResourcesApp.ts" \
8383
--context VERSION_NUMBER=undefined \
8484
--context COMMIT_ID=undefined \
85-
--context allowAutoDeleteObjects=true \
8685
--context logRetentionInDays=30
8786

8887
cdk-diff:

‎cdk.json‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"watch": {
3+
"include": [
4+
"packages/**"
5+
],
6+
"exclude": [
7+
"**/README.md",
8+
"**/cdk*.json",
9+
"**/*.d.ts",
10+
"**/*.js",
11+
"**/tsconfig.json",
12+
"**/package*.json",
13+
"**/yarn.lock",
14+
"**/node_modules",
15+
"**/tests*",
16+
"**/lib",
17+
"**/coverage",
18+
"**/jest.config.ts",
19+
"**/jest.debug.config.ts"
20+
]
21+
},
22+
"context": {
23+
"@aws-cdk/aws-lambda:recognizeLayerVersion": true,
24+
"@aws-cdk/core:checkSecretUsage": true,
25+
"@aws-cdk/core:target-partitions": [
26+
"aws",
27+
"aws-cn"
28+
],
29+
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
30+
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
31+
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
32+
"@aws-cdk/aws-iam:minimizePolicies": true,
33+
"@aws-cdk/core:validateSnapshotRemovalPolicy": true,
34+
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
35+
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
36+
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
37+
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
38+
"@aws-cdk/core:enablePartitionLiterals": true,
39+
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
40+
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
41+
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
42+
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
43+
"@aws-cdk/aws-route53-patters:useCertificate": true,
44+
"@aws-cdk/customresources:installLatestAwsSdkDefault": false,
45+
"@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
46+
"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
47+
"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
48+
"@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
49+
"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
50+
"@aws-cdk/aws-redshift:columnId": true,
51+
"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true,
52+
"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
53+
"@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
54+
"@aws-cdk/aws-kms:aliasNameRef": true,
55+
"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true,
56+
"@aws-cdk/core:includePrefixInUniqueNameGeneration": true,
57+
"@aws-cdk/aws-efs:denyAnonymousAccess": true,
58+
"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true,
59+
"@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion": true,
60+
"@aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId": true,
61+
"@aws-cdk/aws-rds:auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters": true,
62+
"@aws-cdk/aws-appsync:useArnForSourceApiAssociationIdentifier": true,
63+
"@aws-cdk/aws-rds:preventRenderingDeprecatedCredentials": true,
64+
"@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSource": true,
65+
"@aws-cdk/aws-cloudwatch-actions:changeLambdaPermissionLogicalIdForLambdaAction": true,
66+
"@aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalse": true,
67+
"@aws-cdk/aws-codepipeline:defaultPipelineTypeToV2": true,
68+
"@aws-cdk/aws-kms:reduceCrossAccountRegionPolicyScope": true,
69+
"@aws-cdk/aws-eks:nodegroupNameAttribute": true,
70+
"@aws-cdk/aws-ec2:ebsDefaultGp3Volume": true,
71+
"@aws-cdk/aws-ecs:removeDefaultDeploymentAlarm": true,
72+
"@aws-cdk/custom-resources:logApiResponseDataPropertyTrueDefault": false,
73+
"@aws-cdk/aws-s3:keepNotificationInImportedBucket": false
74+
}
75+
}

‎packages/cdk/bin/VpcResourcesApp.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import {App, Aspects, Tags} from "aws-cdk-lib"
22
import {AwsSolutionsChecks} from "cdk-nag"
33

44
import {VpcResourcesStack} from "../stacks/VpcResourcesStack"
5+
import {addCfnGuardMetadata} from "./utils/appUtils"
56

67
const app = new App()
78
/* Required Context:
@@ -18,10 +19,12 @@ Tags.of(app).add("version", version)
1819
Tags.of(app).add("commit", commit)
1920
Tags.of(app).add("cdkApp", "VpcResourcesApp")
2021

21-
new VpcResourcesStack(app, "VpcResourcesStack", {
22+
const VpcResources = new VpcResourcesStack(app, "VpcResourcesStack", {
2223
env: {
2324
region: "eu-west-2"
2425
},
2526
stackName: "vpc-resources",
2627
version: version
2728
})
29+
30+
addCfnGuardMetadata(VpcResources, "Custom::VpcRestrictDefaultSGCustomResourceProvider", "Handler")

‎packages/cdk/bin/utils/appUtils.ts‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
import {Stack, CfnResource} from "aws-cdk-lib"
2+
3+
// function which adds metadata to ignore things which fail cfn-guard
4+
export const addCfnGuardMetadata = (stack: Stack, path: string, childPath: string) => {
5+
const provider = stack.node.tryFindChild(path)
6+
if (provider === undefined) {
7+
return
8+
}
9+
const lambda = provider.node.tryFindChild(childPath) as CfnResource
10+
const role = provider.node.tryFindChild("Role") as CfnResource
11+
if (lambda !== undefined) {
12+
lambda.cfnOptions.metadata = (
13+
{
14+
...lambda.cfnOptions.metadata,
15+
guard: {
16+
SuppressedRules: [
17+
"LAMBDA_DLQ_CHECK",
18+
"LAMBDA_INSIDE_VPC",
19+
"LAMBDA_CONCURRENCY_CHECK"
20+
]
21+
}
22+
}
23+
)
24+
}
25+
if (role !== undefined) {
26+
role.cfnOptions.metadata = (
27+
{
28+
...role.cfnOptions.metadata,
29+
guard: {
30+
SuppressedRules: [
31+
"IAM_NO_INLINE_POLICY_CHECK"
32+
]
33+
}
34+
}
35+
)
36+
}
37+
}

‎packages/cdk/stacks/VpcResourcesStack.ts‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
11
import {
22
App,
33
CfnOutput,
4+
CfnResource,
45
Fn,
56
RemovalPolicy,
67
Stack,
78
StackProps
89
} from "aws-cdk-lib"
9-
import {FlowLogDestination, IpAddresses, Vpc} from "aws-cdk-lib/aws-ec2"
10+
import {
11+
CfnSubnet,
12+
FlowLogDestination,
13+
IpAddresses,
14+
Vpc
15+
} from "aws-cdk-lib/aws-ec2"
1016
import {Role, ServicePrincipal} from "aws-cdk-lib/aws-iam"
1117
import {Key} from "aws-cdk-lib/aws-kms"
1218
import {LogGroup} from "aws-cdk-lib/aws-logs"
@@ -55,6 +61,30 @@ export class VpcResourcesStack extends Stack {
5561
}
5662
})
5763

64+
// Add cfn-guard suppressions
65+
for (const subnet of vpc.publicSubnets) {
66+
const cfnSubnet = subnet.node.defaultChild as CfnSubnet
67+
cfnSubnet.cfnOptions.metadata = {
68+
guard:
69+
{
70+
SuppressedRules:[
71+
"SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED"
72+
]
73+
}
74+
}
75+
76+
const cfnSubnetAsChild = vpc.node.tryFindChild(subnet.node.id) as CfnResource
77+
const cfnDefaultRoute = cfnSubnetAsChild.node.tryFindChild("DefaultRoute") as CfnResource
78+
cfnDefaultRoute.cfnOptions.metadata = {
79+
guard:
80+
{
81+
SuppressedRules:[
82+
"NO_UNRESTRICTED_ROUTE_TO_IGW"
83+
]
84+
}
85+
}
86+
}
87+
5888
//Outputs
5989

6090
//Exports

0 commit comments

Comments
 (0)