(core): CDK Synth Generates report for CFN guards

[justin-masse]

Describe the feature

There are plenty of tools that let you check CFN Templates against defined (or generic) policies to make sure things like * do not end up in APIGW resource policies for example. But right now nothing exists to point this back to CDK code. I can highlight for dev teams in their CFN templates where the problem is but would like a way to also point to the actual CDK code in question.

Use Case

Looking to validate CDK code against company defined policies for what should be able to synth out to a CFN template (or at least provide a report of warnings/etc).

Proposed Solution

At synth time, allow a flag to be passed that would generate a report for warnings either with a "default (AWS defined)" policy of best practices or let users provide some sort of list/json of rules.

Something similar to using: https://github.com/aws-cloudformation/cloudformation-guard

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

doesnt matter

Environment details (OS name and version, etc.)

doesnt matter

[adamjkeller]

Hey @justin-masse, have you seen the policy validation at synthesis feature? If i'm understanding your ask correctly, you are looking for the ability to run the synthesized CloudFormation template against policy as code definitions using something like CloudFormation Guard. If that's the case, the policy at synth feature will help you accomplish that. Today there are a couple of supported plugins, check em out and hopefully they can help you.

CFN Guard Plugin
KICS CDK Validator Plugin

[ashishdhingra]

@adamjkeller Thanks for your reply.

[justin-masse]

Hey @justin-masse, have you seen the policy validation at synthesis feature? If i'm understanding your ask correctly, you are looking for the ability to run the synthesized CloudFormation template against policy as code definitions using something like CloudFormation Guard. If that's the case, the policy at synth feature will help you accomplish that. Today there are a couple of supported plugins, check em out and hopefully they can help you.

CFN Guard Plugin KICS CDK Validator Plugin

That may very well be it, let me dig in more to the implementation. Admittedly I just assumed this had not been implemented yet instead of checking first (my bad)

[justin-masse]

This will work!

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.