Enable AWS Solutions Checks from cdk-nag

mellevanderlinde · Jan 25, 2025 · aac8d41 · aac8d41
1 parent 3c09932
commit aac8d41
Show file tree

Hide file tree

Showing 5 changed files with 137 additions and 8 deletions.
diff --git a/apps/infra/bin/portfolio.ts b/apps/infra/bin/portfolio.ts
@@ -7,6 +7,7 @@ import {
   type IAspect,
   RemovalPolicy,
 } from "aws-cdk-lib";
+import { AwsSolutionsChecks } from "cdk-nag";
 import type { IConstruct } from "constructs";
 import { PortfolioStack } from "../lib/portfolio-stack";
 
@@ -25,4 +26,6 @@ new PortfolioStack(app, "PortfolioStack", {
     region: "us-east-1", // Required, see https://docs.aws.amazon.com/acm/latest/userguide/acm-regions.html
   },
 });
+
 Aspects.of(app).add(new RemovalPolicyDestroyAspect());
+Aspects.of(app).add(new AwsSolutionsChecks());
diff --git a/apps/infra/lib/portfolio-stack.ts b/apps/infra/lib/portfolio-stack.ts
@@ -12,6 +12,7 @@ import {
   aws_s3 as s3,
   aws_s3_deployment as s3_deployment,
 } from "aws-cdk-lib";
+import { NagSuppressions } from "cdk-nag";
 import type { Construct } from "constructs";
 
 export class PortfolioStack extends Stack {
@@ -32,6 +33,13 @@ export class PortfolioStack extends Stack {
       autoDeleteObjects: true,
     });
 
+    NagSuppressions.addResourceSuppressions(bucket, [
+      {
+        id: "AwsSolutions-S1",
+        reason: "Server access logging is not required",
+      },
+    ]);
+
     const certificate = new certificatemanager.Certificate(
       this,
       "Certificate",
@@ -97,6 +105,17 @@ export class PortfolioStack extends Stack {
       ),
     });
 
+    NagSuppressions.addResourceSuppressions(distribution, [
+      {
+        id: "AwsSolutions-CFR2",
+        reason: "AWS WAF is not required",
+      },
+      {
+        id: "AwsSolutions-CFR3",
+        reason: "Access logging is not required",
+      },
+    ]);
+
     const target = route53.RecordTarget.fromAlias(
       new route53_targets.CloudFrontTarget(distribution),
     );
@@ -137,13 +156,43 @@ export class PortfolioStack extends Stack {
       retention: logs.RetentionDays.ONE_DAY,
     });
 
-    new s3_deployment.BucketDeployment(this, "BucketDeployment", {
-      destinationBucket: bucket,
-      sources: [s3_deployment.Source.asset("../website/out")],
-      distribution,
-      distributionPaths: ["/*"],
-      logGroup,
-      memoryLimit: 2048,
-    });
+    const bucketDeployment = new s3_deployment.BucketDeployment(
+      this,
+      "BucketDeployment",
+      {
+        destinationBucket: bucket,
+        sources: [s3_deployment.Source.asset("../website/out")],
+        distribution,
+        distributionPaths: ["/*"],
+        logGroup,
+        memoryLimit: 2048,
+      },
+    );
+
+    NagSuppressions.addResourceSuppressionsByPath(
+      this,
+      "/PortfolioStack/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C2048MiB/Resource",
+      [
+        {
+          id: "AwsSolutions-L1",
+          reason: "This Lambda is managed by CDK",
+        },
+      ],
+    );
+
+    NagSuppressions.addResourceSuppressions(
+      bucketDeployment.handlerRole,
+      [
+        {
+          id: "AwsSolutions-IAM5",
+          reason: "Full S3 access is required",
+        },
+        {
+          id: "AwsSolutions-IAM4",
+          reason: "Write access to CloudWatch is allowed",
+        },
+      ],
+      true,
+    );
   }
 }
diff --git a/apps/infra/package.json b/apps/infra/package.json
@@ -13,6 +13,7 @@
   "devDependencies": {
     "@types/node": "^22.10.10",
     "aws-cdk": "^2.177.0",
+    "cdk-nag": "^2.35.0",
     "ts-node": "^10.9.2",
     "typescript": "^5.7.3",
     "vitest": "^3.0.4"

diff --git a/apps/infra/test/__snapshots__/stack.test.ts.snap b/apps/infra/test/__snapshots__/stack.test.ts.snap
@@ -72,6 +72,16 @@ exports[`Match with snapshot 1`] = `
     },
     "Bucket83908E77": {
       "DeletionPolicy": "Delete",
+      "Metadata": {
+        "cdk_nag": {
+          "rules_to_suppress": [
+            {
+              "id": "AwsSolutions-S1",
+              "reason": "Server access logging is not required",
+            },
+          ],
+        },
+      },
       "Properties": {
         "BucketName": "mellevanderlinde.com",
         "PublicAccessBlockConfiguration": {
@@ -314,6 +324,16 @@ exports[`Match with snapshot 1`] = `
         "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C2048MiBServiceRoleDefaultPolicy5D765796",
         "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C2048MiBServiceRoleB37F9ACF",
       ],
+      "Metadata": {
+        "cdk_nag": {
+          "rules_to_suppress": [
+            {
+              "id": "AwsSolutions-L1",
+              "reason": "This Lambda is managed by CDK",
+            },
+          ],
+        },
+      },
       "Properties": {
         "Code": {
           "S3Bucket": "cdk-hnb659fds-assets-012345678912-us-east-1",
@@ -348,6 +368,20 @@ exports[`Match with snapshot 1`] = `
       "Type": "AWS::Lambda::Function",
     },
     "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C2048MiBServiceRoleB37F9ACF": {
+      "Metadata": {
+        "cdk_nag": {
+          "rules_to_suppress": [
+            {
+              "id": "AwsSolutions-IAM5",
+              "reason": "Full S3 access is required",
+            },
+            {
+              "id": "AwsSolutions-IAM4",
+              "reason": "Write access to CloudWatch is allowed",
+            },
+          ],
+        },
+      },
       "Properties": {
         "AssumeRolePolicyDocument": {
           "Statement": [
@@ -379,6 +413,20 @@ exports[`Match with snapshot 1`] = `
       "Type": "AWS::IAM::Role",
     },
     "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C2048MiBServiceRoleDefaultPolicy5D765796": {
+      "Metadata": {
+        "cdk_nag": {
+          "rules_to_suppress": [
+            {
+              "id": "AwsSolutions-IAM5",
+              "reason": "Full S3 access is required",
+            },
+            {
+              "id": "AwsSolutions-IAM4",
+              "reason": "Write access to CloudWatch is allowed",
+            },
+          ],
+        },
+      },
       "Properties": {
         "PolicyDocument": {
           "Statement": [
@@ -530,6 +578,20 @@ exports[`Match with snapshot 1`] = `
       "Type": "AWS::IAM::Role",
     },
     "Distribution830FAC52": {
+      "Metadata": {
+        "cdk_nag": {
+          "rules_to_suppress": [
+            {
+              "id": "AwsSolutions-CFR2",
+              "reason": "AWS WAF is not required",
+            },
+            {
+              "id": "AwsSolutions-CFR3",
+              "reason": "Access logging is not required",
+            },
+          ],
+        },
+      },
       "Properties": {
         "DistributionConfig": {
           "Aliases": [

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml