Skip to content

Commit 288df2c

Browse files
curtismscurtisms
committed
Upgraded CDK version to 2.261.0 so that CdkNag checks are processed successfully and will fail the build when applicable.
Updated UnicornStoreApp.java so that it handles the IAM suppressions that now require metadata.
1 parent 4af3206 commit 288df2c

2 files changed

Lines changed: 24 additions & 21 deletions

File tree

‎labs/unicorn-store/infrastructure/cdk/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<properties>
1111
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1212
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
13-
<cdk.version>2.257.0</cdk.version>
13+
<cdk.version>2.261.0</cdk.version>
1414
<junit.version>6.1.0</junit.version>
1515
</properties>
1616

@@ -21,8 +21,8 @@
2121
<artifactId>maven-compiler-plugin</artifactId>
2222
<version>3.15.0</version>
2323
<configuration>
24-
<source>17</source>
25-
<target>17</target>
24+
<source>25</source>
25+
<target>25</target>
2626
</configuration>
2727
</plugin>
2828

‎labs/unicorn-store/infrastructure/cdk/src/main/java/com/unicorn/UnicornStoreApp.java‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package com.unicorn;
22

3-
import java.util.Collections;
4-
import java.util.List;
3+
import java.util.HashMap;
54

65
import com.unicorn.alternatives.UnicornAuditService;
76
import com.unicorn.alternatives.UnicornStoreMicronaut;
@@ -10,6 +9,7 @@
109
import com.unicorn.core.InfrastructureStack;
1110

1211
import io.github.cdklabs.cdknag.AwsSolutionsChecks;
12+
import io.github.cdklabs.cdknag.NagPackProps;
1313
import software.amazon.awscdk.*;
1414

1515
public class UnicornStoreApp {
@@ -20,31 +20,30 @@ public static void main(final String[] args) {
2020
var infrastructureStack = new InfrastructureStack(app, "UnicornStoreInfrastructure", StackProps.builder()
2121
.build());
2222

23-
var unicornStoreSpring = new UnicornStoreStack(app, "UnicornStoreSpringApp", StackProps.builder()
23+
new UnicornStoreStack(app, "UnicornStoreSpringApp", StackProps.builder()
2424
.build(), infrastructureStack);
2525

26-
var unicornStoreMicronaut = new UnicornStoreMicronaut(app, "UnicornStoreMicronautApp", StackProps.builder()
26+
new UnicornStoreMicronaut(app, "UnicornStoreMicronautApp", StackProps.builder()
2727
.build(), infrastructureStack);
2828

29-
var unicornStoreSpringGraalVM = new UnicornStoreSpringGraalVM(app, "UnicornStoreSpringGraalVMApp", StackProps.builder()
29+
new UnicornStoreSpringGraalVM(app, "UnicornStoreSpringGraalVMApp", StackProps.builder()
3030
.build(), infrastructureStack);
3131

32-
var unicornStoreQuarkus = new UnicornStoreQuarkus(app, "UnicornStoreQuarkusApp", StackProps.builder()
32+
new UnicornStoreQuarkus(app, "UnicornStoreQuarkusApp", StackProps.builder()
3333
.build(), infrastructureStack);
3434

35-
var unicornAuditService = new UnicornAuditService(app, "UnicornAuditServiceApp", StackProps.builder()
35+
new UnicornAuditService(app, "UnicornAuditServiceApp", StackProps.builder()
3636
.build(), infrastructureStack);
3737

38-
3938
//Add CDK-NAG checks: https://github.com/cdklabs/cdk-nag
39+
Validations.of(app).addPlugins(new AwsSolutionsChecks(app,
40+
NagPackProps.builder().writeSuppressionsToCloudFormation(true).build()));
41+
4042
//Add suppression to exclude certain findings that are not needed for Workshop environment
41-
Validations.of(app).addPlugins(new AwsSolutionsChecks());
42-
var suppression = List.of(
43+
Validations.of(app).acknowledge(
4344
new Acknowledgment.Builder().id("AwsSolutions-APIG4").reason("The workshop environment does not require API-Gateway authorization").build(),
4445
new Acknowledgment.Builder().id("AwsSolutions-COG4").reason("The workshop environment does not require Cognito User Pool authorization").build(),
4546
new Acknowledgment.Builder().id("AwsSolutions-RDS3").reason("Workshop environment does not need a Multi-AZ setup to reduce cost").build(),
46-
new Acknowledgment.Builder().id("AwsSolutions-IAM4").reason("AWS Managed policies are acceptable for the workshop").build(),
47-
new Acknowledgment.Builder().id("AwsSolutions-IAM5").reason("A wildcard is acceptable for this workshop to allow parallel creation of resources").build(),
4847
new Acknowledgment.Builder().id("AwsSolutions-RDS10").reason("Workshop environment is ephemeral and the database should be deleted by the end of the workshop").build(),
4948
new Acknowledgment.Builder().id("AwsSolutions-RDS11").reason("Database is in a private subnet and can use the default port").build(),
5049
new Acknowledgment.Builder().id("AwsSolutions-APIG2").reason("API Gateway request validation is not needed for workshop").build(),
@@ -59,12 +58,16 @@ public static void main(final String[] args) {
5958
new Acknowledgment.Builder().id("CdkNagValidationFailure").reason("Suppress warnings see: https://github.com/cdklabs/cdk-nag/issues/817").build()
6059
);
6160

62-
Validations.of(infrastructureStack).acknowledge(suppression.toArray(new Acknowledgment[0]));
63-
Validations.of(unicornStoreSpring).acknowledge(suppression.toArray(new Acknowledgment[0]));
64-
Validations.of(unicornStoreMicronaut).acknowledge(suppression.toArray(new Acknowledgment[0]));
65-
Validations.of(unicornStoreSpringGraalVM).acknowledge(suppression.toArray(new Acknowledgment[0]));
66-
Validations.of(unicornStoreQuarkus).acknowledge(suppression.toArray(new Acknowledgment[0]));
67-
Validations.of(unicornAuditService).acknowledge(suppression.toArray(new Acknowledgment[0]));
61+
// Suppress parameterized IAM findings directly via metadata
62+
// (Validations.acknowledge() rejects IDs containing '::' due to CDK delimiter validation bug)
63+
var iamSuppressions = new HashMap<String, String>();
64+
iamSuppressions.put("AwsSolutions-IAM4", "AWS Managed policies are acceptable for the workshop");
65+
iamSuppressions.put("AwsSolutions-IAM5", "A wildcard is acceptable for this workshop to allow parallel creation of resources");
66+
iamSuppressions.put("AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]", "AWS Managed policies are acceptable for the workshop");
67+
iamSuppressions.put("AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole]", "AWS Managed policies are acceptable for the workshop");
68+
iamSuppressions.put("AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs]", "AWS Managed policies are acceptable for the workshop");
69+
iamSuppressions.put("AwsSolutions-IAM5[Resource::arn:aws:secretsmanager:*:*:secret:unicornstore-db-secret-*]", "A wildcard is acceptable for this workshop");
70+
app.getNode().addMetadata(Validations.ACKNOWLEDGED_RULES_METADATA_KEY, iamSuppressions);
6871

6972
app.synth();
7073
}

0 commit comments

Comments
 (0)