cfn_nag metadata

Author: Bob Strahan

template.yaml

@@ -3549,6 +3549,11 @@ Resources:
   A2IHumanTaskUILambdaRole:
     Type: AWS::IAM::Role
     Condition: IsPattern1HITLEnabled
+    Metadata:
+      cfn_nag:
+        rules_to_suppress:
+          - id: W11
+            reason: "Role requires * resource access for SageMaker A2I operations as resource name is not available"
     Properties:
       AssumeRolePolicyDocument:
         Version: '2012-10-17'
@@ -3671,6 +3676,16 @@ Resources:
   GetWorkforceURLFunction:
     Type: AWS::Serverless::Function
     Condition: IsPattern1HITLEnabled
+    Metadata:
+      cfn_nag:
+        rules_to_suppress:
+          - id: W89
+            reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
+          - id: W92
+            reason: "Function does not require reserved concurrency as it scales based on demand"
+    # checkov:skip=CKV_AWS_116: "DLQ not required for Cfn Custom Resource function"
+    # checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
+    # checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
     Properties:
       Handler: index.handler
       Runtime: python3.12