ci: security guardian changes (#36110)

### Issue # (if applicable)

N/A - Enhancement and bug fixes for Security Guardian tool.

### Reason for this change

Security guardian is first line of defense for scanning policy, roles and permissions vended by CDK for customers. This GH Action is critical to determine if a PR change is providing secure-by-default policies for any changes introduced in CDK.

The Security Guardian tool needed several critical improvements to function properly:
1. **CFN Intrinsic Resolution**: Missing comprehensive support for CloudFormation intrinsic functions like `Fn::Sub`, `Fn::Select`, `Fn::Contains`, etc.
2. **Rule Coverage**: Incomplete security rule coverage across AWS services
3. **Create noise**: Current setup of security guardian does not provide benefit as it fails to exclude cases where the generic cfn-guard rule might not work. Like with KMS secrets or secret manager secrets

### Description of changes

Added template preprocessing pipeline with intrinsic resolution and policy normalization, details can be found below

**Major Enhancements:**
- **Complete CFN Intrinsic Function Resolver**: Added comprehensive support for all CloudFormation intrinsic functions including `Fn::Sub` with literal escaping, `Fn::Select` with bounds checking, `Fn::Contains`, `Fn::Split`, `Fn::Cidr`, `Fn::Base64`, and shorthand forms (`!Ref`, `!GetAtt`, etc.)
- **Cross-Stack Resolution**: Implemented resource registry for resolving `Fn::ImportValue` and cross-template references
- **Policy Normalization**: Added IAM policy normalizer to resolve intrinsics within policy documents before validation
- **Output presentation**: Integrated JUnit XML output with GitHub Actions using pinned `mikepenz/action-junit-report` for rich PR feedback ( suggested by cfn-guard [here](https://github.com/aws-cloudformation/cloudformation-guard/blob/main/guard-examples/ci/.github/workflows/junit-test-and-validate.yml))
- **Security report generation workflow** : Separated out report generation into another workflow due to 2 reasons : 
     - Gives us flexibility to change the trigger type for security-guardian to lower permissive trigger like`pull_request` or `pull_request_review`
     - Allows fork PRs to run : Fork PRs trigger workflow runs with read permissions, and the separate workflow can execute separate from the fork PR call chain with full permissions needed to update checks and annotation on the PR

**Security Rule Expansion:**
- Added comprehensive guard rules for 13 AWS services: CodePipeline, DataTrace, DocumentDB, EC2, IAM, Kinesis, Neptune, Redshift, S3, SNS, SQS, and trust scope validation
- Enhanced existing rules with better coverage for broad principals, wildcard actions, and cross-account access patterns


### Describe any new or updated permissions being added

No new IAM permissions required. All changes are to the static analysis tool and GitHub Actions workflow.

### Description of how you validated changes

 **Unit Testing**: via
- **Guard Rule Syntax**: All 13 guard rule files pass cfn-guard v3 parser validation
- **Cross-Stack Testing**: Validated resolution of `Fn::ImportValue` and cross-template references
- **Example cases** to test that the current set of rules PASS and FAIL for different scenarios

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: kumvprat

.github/workflows/security-guardian.yml

@@ -1,6 +1,6 @@
 name: Security Guardian
 on:
-  pull_request: {}
+  pull_request_target: {}
 
 jobs:
   log-skip:
@@ -34,10 +34,21 @@ jobs:
         run: yarn install --frozen-lockfile && cd tools/@aws-cdk/security-guardian && yarn build
 
       - name: Run Security Guardian
+        id: security-guardian
         uses: ./tools/@aws-cdk/security-guardian
         with:
           base_sha: ${{ github.event.pull_request.base.sha }}
           head_sha: ${{ github.event.pull_request.head.sha }}
           rule_set_path: './tools/@aws-cdk/security-guardian/rules'
-          show_summary: 'fail'
-          output_format: 'json'
+      - name: Save PR info for security-report
+        if: always()
+        run: |
+          echo "${{ github.event.pull_request.number }}" > ./test-results/pr_number
+          echo "${{ github.event.pull_request.head.sha }}" > ./test-results/pr_sha
+      
+      - name: Upload Security Guardian XML Reports
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: security-guardian-reports
+          path: test-results/

.github/workflows/security-report.yml

@@ -0,0 +1,65 @@
+name: Security Report
+on:
+  workflow_run:
+    workflows: ["Security Guardian"]
+    types: [completed]
+
+jobs:
+  report:
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
+      id-token: write
+      actions: read
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v5
+        with:
+          name: security-guardian-reports
+          path: test-results/
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          repository: ${{ github.repository }}
+      
+      - name: Get PR info
+        id: pr_info
+        run: |
+          echo "pr_number=$(cat test-results/pr_number)" >> "$GITHUB_OUTPUT"
+          echo "pr_sha=$(cat test-results/pr_sha)" >> "$GITHUB_OUTPUT"
+          echo "PR: $(cat test-results/pr_number), SHA: $(cat test-results/pr_sha)"
+      - name: Publish Security Test Results 
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: 'test-results/**/cfn-guard-static.xml'
+          check_name: 'Security Guardian Results'
+          exclude_sources: 'node_modules,dist'
+          commit: ${{ steps.pr_info.outputs.pr_sha }}
+          check_annotations: true
+          comment: true
+          pr_id: ${{ steps.pr_info.outputs.pr_number }}
+          detailed_summary: true
+          include_passed: false
+          fail_on_failure: false
+          group_suite: true
+          include_skipped: false
+          check_title_template: '{{TEST_NAME}}'
+
+      - name: Publish Security Test Results for resolved templates
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: 'test-results/**/cfn-guard-resolved.xml'
+          check_name: 'Security Guardian Results with resolved templates'
+          exclude_sources: 'node_modules,dist'
+          commit: ${{ steps.pr_info.outputs.pr_sha }}
+          check_annotations: true
+          comment: true
+          pr_id: ${{ steps.pr_info.outputs.pr_number }}
+          detailed_summary: true
+          include_passed: false
+          fail_on_failure: false
+          group_suite: true
+          include_skipped: false
+          check_title_template: '{{TEST_NAME}}'

tools/@aws-cdk/security-guardian/README.md

@@ -4,6 +4,8 @@ A GitHub Action and CLI tool that helps detect broadly scoped IAM principals in
 
 - Validating **changed** `*.template.json` files in pull requests using custom [cfn-guard v3](https://github.com/aws-cloudformation/cloudformation-guard) rules.
 - Detecting **broadly scoped IAM principals** using CloudFormation **intrinsic functions** (e.g., `Fn::Join` with `:root`).
+- **Cross-account wildcard detection** - Flags dangerous patterns like `"*"` or `"arn:aws:iam::*:root"`.
+- **Extensible exemption system** - Smart exemptions for AWS service default policies.
 
 ---
 
@@ -12,32 +14,92 @@ A GitHub Action and CLI tool that helps detect broadly scoped IAM principals in
  Validates **only changed** templates in a PR  
  Supports **cfn-guard v3** with rule sets  
  Scans for **broad IAM principals using intrinsics**  
+ **Flags cross-account wildcards** - Always dangerous  
+ **Extensible exemptions** for AWS service defaults  
+ **Future-proof validation** - Detects when AWS changes default policies  
  Runs locally and in GitHub Actions  
  Outputs human-readable and machine-parsable summaries
 
 ---
 
+## Security Checks
+
+### Rule Organization
+Guard rules are organized in service-specific directories for granular control:
+
+```
+rules/
+├── codepipeline/
+│   └── cross-account-role-trust-scope.guard
+├── documentdb/
+│   └── encryption-enabled.guard
+├── ec2/
+│   ├── ebs-encryption-enabled.guard
+│   └── no-open-security-groups.guard
+├── guard-hooks/
+│   └── no-root-principals-except-kms-secrets.guard
+├── iam/
+│   ├── no-overly-permissive-passrole.guard
+│   ├── no-wildcard-actions.guard
+│   ├── no-world-accessible-trust-policy.guard
+│   ├── policy-no-broad-principals.guard
+│   └── role-no-broad-principals.guard
+├── s3/
+│   ├── encryption-enabled.guard
+│   ├── no-world-readable.guard
+│   └── secure-transport.guard
+└── [other services...]
+```
+
+### Always Flagged (High Risk)
+- **Cross-account wildcards**: `"*"` or `"arn:aws:iam::*:root"`
+- **Custom policies with root access**: Non-default policies granting root
+- **Broad principals in sensitive resources**: IAM roles, S3 buckets, etc.
+
+### Smart Exemptions (Configurable)
+- **AWS KMS default policies**: Standard root access for IAM integration
+- **Individual rule control**: Enable/disable specific rules per service
+- **Metadata-based suppression**: Use CDK metadata to suppress specific rules
+
+---
+
 ## Inputs (GitHub Action)
 
-| Name             | Description                                          | Required | Default               |
-|------------------|------------------------------------------------------|----------|-----------------------|
-| `rule_set_path`  | Local path to the cfn-guard rules file               | No       | `./rules`             |
-| `show_summary`   | Show summary (`none`, `all`, `pass`, `fail`, `skip`) | No       | `fail`                |
-| `output_format`  | Output format (`single-line-summary`, `json`, etc.)  | No       | `single-line-summary` |
-| `base_sha`       | Commit SHA to compare against                        | No       | `origin/main`         |
-| `head_sha`       | The commit SHA for the head (current) branch or PR   | No       | `HEAD`                |
+| Name            | Description                               | Required | Default       |
+|-----------------|-------------------------------------------|----------|---------------|
+| `rule_set_path` | Local path to the cfn-guard rules file   | Yes      | N/A           |
+| `base_sha`      | Commit SHA to compare against             | No       | `origin/main` |
+| `head_sha`      | The commit SHA for the head branch or PR | No       | `HEAD`        |
+| `enhance_xml`   | Enable XML enhancement for individual failure annotations | No | `true` |
+
+## Outputs (GitHub Action)
+
+| Name         | Description                               |
+|--------------|-------------------------------------------|
+| `junit_files`| Comma-separated list of JUnit XML files  |
+| `all_passed` | Whether all validations passed            |
 
 ---
 
 ## Usage (GitHub Action)
 
 ```yaml
 - name: Run Security Guardian
+  id: security-guardian
   uses: ./tools/@aws-cdk/security-guardian
   with:
     rule_set_path: './tools/@aws-cdk/security-guardian/rules'
-    show_summary: 'fail'
-    output_format: 'single-line-summary'
+    enhance_xml: 'true'  # Optional: Enable individual failure annotations (default: true)
+
+- name: Publish Security Test Results
+  uses: mikepenz/action-junit-report@e08919a3b1fb83a78393dfb775a9c37f17d8eea6  # v6.0.1
+  if: always()
+  with:
+    report_paths: 'test-results/*.xml'
+    check_name: 'Security Guardian Results'
+    detailed_summary: true
+    include_passed: true
+    fail_on_failure: true
 ```
 
 ---
@@ -58,32 +120,83 @@ yarn security-guardian
 
 > You can override defaults using:
 > - `--base_sha=origin/main`  
-> - `--output_format=json`  
-> - `--show_summary=warn`
+> - `--rule_set_path=./custom-rules`
 
 ---
 
 ## Output
 
-In addition to validation results from `cfn-guard`, the tool logs detailed findings from the intrinsic scan (if applicable), such as:
+The tool generates JUnit XML reports that can be consumed by GitHub Actions:
+
+- `test-results/cfn-guard-static.xml` - Results from original templates
+- `test-results/cfn-guard-resolved.xml` - Results from templates with resolved intrinsics
+
+Use `mikepenz/action-junit-report@e08919a3b1fb83a78393dfb775a9c37f17d8eea6` (v6.0.1) to display rich test results in GitHub PRs with:
+- **Enhanced failure messages** - Automatically parses and formats concatenated CFN Guard failures
+- **Precise line numbers** - Exact file locations for each violation
+- **Resource identification** - Clear resource names and property paths
+- **Rule descriptions** - Detailed explanations and remediation guidance
+
+### Enhanced Failure Formatting
 
+The tool automatically enhances CFN Guard failure messages by:
+- Splitting concatenated failure messages into individual violations
+- Extracting exact line numbers and column positions
+- Identifying specific CloudFormation resources and properties
+- Formatting output for better readability in CI/CD reports
+
+**Before (Raw CFN Guard Output):**
+```
+IAM_NO_WILDCARD_ACTIONS_INLINE for Type: ResolvedCheck was not compliant as property [Policies[*].PolicyDocument.Statement[*]] is missing. Value traversed to [Path=/Resources/Role1/Properties[L:324,C:20]]Check was not compliant as property [Policies[*].PolicyDocument.Statement[*]] is missing. Value traversed to [Path=/Resources/Role2/Properties[L:485,C:20]]
+```
+
+**After (Enhanced Format):**
 ```
-detailed_output File: changed_templates/example.template.json
-{
-  "Action": "kms:*",
-  "Effect": "Allow",
-  "Principal": {
-    "AWS": {
-      "Fn::Join": [
-        "",
-        ["arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root"]
-      ]
-    }
-  },
-  "Resource": "*"
+Rule: IAM_NO_WILDCARD_ACTIONS_INLINE (Type: Resolved)
+==================================================
+
+- Check was not compliant as property [Policies[*].PolicyDocument.Statement[*]] is missing. Value traversed to [Path=/Resources/Role1/Properties[L:324,C:20]]
+- Check was not compliant as property [Policies[*].PolicyDocument.Statement[*]] is missing. Value traversed to [Path=/Resources/Role2/Properties[L:485,C:20]]
+```
+
+---
+
+## Suppressing Rules
+
+For integration tests or specific resources that generate false positives, you can suppress individual rules using CDK metadata:
+
+```typescript
+import { Bucket } from 'aws-cdk-lib/aws-s3';
+import { Stack, StackProps } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+
+export class MyTestStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+
+    const testBucket = new Bucket(this, 'TestBucket', {
+      autoDeleteObjects: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+
+    // Suppress S3 encryption rule for integration test
+    testBucket.node.addMetadata('guard', {
+      SuppressedRules: ['S3_ENCRYPTION_ENABLED']
+    });
+  }
 }
 ```
 
+**Available Rules to Suppress:**
+- `S3_ENCRYPTION_ENABLED`
+- `IAM_ROLE_NO_BROAD_PRINCIPALS` 
+- `IAM_NO_WILDCARD_ACTIONS`
+- `NO_ROOT_PRINCIPALS_EXCEPT_KMS_SECRETS`
+- `EBS_ENCRYPTION_ENABLED`
+- `SNS_ENCRYPTION_ENABLED`
+- `SQS_ENCRYPTION_ENABLED`
+- And others (see individual `.guard` files in service subdirectories)
+
 ---
 
 ## Acknowledgments

tools/@aws-cdk/security-guardian/action.yml

@@ -2,20 +2,25 @@ name: 'Security Guardian'
 description: 'Security Guardian for custom or granular guard rules'
 
 inputs:
-  data_directory:
-    description: "Path to CloudFormation templates"
-    required: true
+  base_sha:
+    description: "Base commit id"
+    required: false
+  head_sha:
+    description: "Current changes commit id"
+    required: false
   rule_set_path:
     description: "Path to a single .guard file locally"
     required: true
-  show_summary:
-    description: "cfn-guard summary output. Options are all, pass, fail, skip or none"
+  enhance_xml:
+    description: "Enable XML enhancement for individual failure annotations"
     required: false
-    default: "fail"
-  output_format:
-    description: "cfn-guard output format. Options: json, yaml, single-line-summary"
-    required: false
-    default: "single-line-summary"
+    default: 'true'
+
+outputs:
+  junit_files:
+    description: "Comma-separated list of JUnit XML files"
+  all_passed:
+    description: "Whether all validations passed"
 
 runs:
   using: node20