<!--
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
SPDX-License-Identifier: Apache-2.0
-->
# cdk-nag
| Language | cdk-nag | monocdk-nag |
| ---------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| Python | [](https://badge.fury.io/py/cdk-nag) | [](https://badge.fury.io/py/monocdk-nag) |
| TypeScript | [](https://badge.fury.io/js/cdk-nag) | [](https://badge.fury.io/js/monocdk-nag) |
Check CDK applications for best practices using a combination of available rule packs. Inspired by [cfn_nag](https://github.com/stelligent/cfn_nag)
## Available Packs
See [RULES](./RULES.md) for more information on all the available packs.
1. [AWS Solutions](./RULES.md#awssolutions)
2. [HIPAA Security](./RULES.md#hipaa-security) (In Progress)
3. [NIST 800-53](./RULES.md#nist-800-53)
## Usage
### cdk
```python
# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
from aws_cdk.core import App, Aspects
from ...lib.cdk_test_stack import CdkTestStack
from cdk_nag import AwsSolutionsChecks
app = App()
CdkTestStack(app, "CdkNagDemo")
# Simple rule informational messages
Aspects.of(app).add(AwsSolutionsChecks())
```
### monocdk
```python
# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
from monocdk import App, Aspects
from monocdk_nag import AwsSolutionsChecks
from ...lib.my_stack import MyStack
app = App()
CdkTestStack(app, "CdkNagDemo")
# Simple rule informational messages
Aspects.of(app).add(AwsSolutionsChecks())
```
## Suppressing a Rule
<details>
<summary>Example 1) Default Construct</summary>
```python
# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
test = SecurityGroup(self, "test",
vpc=Vpc(self, "vpc")
)
test.add_ingress_rule(Peer.any_ipv4(), Port.all_traffic())
test_cfn = test.node.default_child
test_cfn.add_metadata("cdk_nag",
rules_to_suppress=[{"id": "AwsSolutions-EC23", "reason": "at least 10 characters"}
]
)
```
</details><details>
<summary>Example 2) Dependent Constructs</summary>
```python
# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
user = User(self, "rUser")
user.add_to_policy(
PolicyStatement(
actions=["s3:PutObject"],
resources=[Bucket(self, "rBucket").arn_for_objects("*")]
))
cfn_user = user.node.children
for child in cfn_user:
resource = child.node.default_child
if resource != undefined && resource.cfn_resource_type == "AWS::IAM::Policy":
resource.add_metadata("cdk_nag",
rules_to_suppress=[{
"id": "AwsSolutions-IAM5",
"reason": "The user is allowed to put objects on all prefixes in the specified bucket."
}
]
)
```
</details>
## Rules and Property Overrides
In some cases L2 Constructs do not have a native option to remediate an issue and must be fixed via [Raw Overrides](https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html#cfn_layer_raw). Since raw overrides take place after template synthesis these fixes are not caught by the cdk_nag. In this case you should remediate the issue and suppress the issue like in the following example.
<details>
<summary>Example) Property Overrides</summary>
```python
# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
instance = Instance(stack, "rInstance",
vpc=Vpc(stack, "rVpc"),
instance_type=InstanceType(InstanceClass.T3),
machine_image=MachineImage.latest_amazon_linux()
)
cfn_ins = instance.node.default_child
cfn_ins.add_property_override("DisableApiTermination", True)
cfn_ins.add_metadata("cdk_nag",
rules_to_suppress=[{
"id": "AwsSolutions-EC29",
"reason": "Remediated through property override "
}
]
)
```
</details>
## Contributing
See [CONTRIBUTING](./CONTRIBUTING.md) for more information.
## License
This project is licensed under the Apache-2.0 License.
monocdk-nag-0.0.96.tar.gz （17个子文件） 
monocdk-nag-0.0.96 
MANIFEST.in 23B PKG-INFO 5KB NOTICE 105B pyproject.toml 106B LICENSE 11KB src monocdk_nag.egg-info PKG-INFO 5KB
requires.txt 89B SOURCES.txt 391B top_level.txt 12B dependency_links.txt 1B monocdk_nag py.typed 1B _jsii monocdk-nag@0.0.96.jsii.tgz 728KB __init__.py 357B __init__.py 11KB setup.cfg 38B setup.py 2KB README.md 4KB
评论0