|
| 1 | +# cdk-nag / CDK version ceiling |
| 2 | + |
| 3 | +## Current pinned versions |
| 4 | +- `aws-cdk-lib`: **2.250.0** |
| 5 | +- `cdk-nag`: **2.38.2** |
| 6 | +- EKS: stable `software.amazon.awscdk.services.eks_v2` (the deprecated `eks-v2-alpha` module was dropped). |
| 7 | + |
| 8 | +`cdk synth` passes with **0 cdk-nag findings** under the latest CDK CLI with this |
| 9 | +combination. IAM4/IAM5 suppressions in `WorkshopApp` carry explicit `appliesTo` |
| 10 | +evidence (a bare `AwsSolutions-IAM5` id does not suppress). |
| 11 | + |
| 12 | +## Why not newer |
| 13 | + |
| 14 | +`aws-cdk-lib` 2.251.0 introduced CDK's native policy-validation framework |
| 15 | +(`software.amazon.awscdk.Validations`). From 2.251 onward, cdk-nag findings are |
| 16 | +routed through it and must be suppressed via `Validations.of(scope).acknowledge()` |
| 17 | +instead of `NagSuppressions`. |
| 18 | + |
| 19 | +That acknowledge API treats `::` as a reserved `prefix::ruleName` delimiter, so it |
| 20 | +rejects finding ids that embed IAM ARNs (which contain `iam::aws` and |
| 21 | +`arn:<AWS::Partition>:...`), e.g.: |
| 22 | + |
| 23 | + AwsSolutions::AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/AdministratorAccess] |
| 24 | + -> InvalidValidationId: The '::' delimiter is reserved for separating the prefix from the rule name |
| 25 | + |
| 26 | +Because every AWS managed-policy finding embeds `iam::aws`, IAM4/IAM5 findings |
| 27 | +cannot currently be acknowledged on aws-cdk-lib >= 2.251. |
| 28 | + |
| 29 | +cdk-nag 3.x does not help: its `NagPack` is plugin-only |
| 30 | +(`IPolicyValidationPlugin`, no `IAspect`), so it relies entirely on the same |
| 31 | +native `acknowledge` mechanism and cannot run report-only either. |
| 32 | + |
| 33 | +Verified: 2.250 synth passes (0 findings); 2.260 synth fails with 19 IAM4/IAM5 |
| 34 | +findings even with correct `appliesTo`. |
| 35 | + |
| 36 | +## Trigger to update |
| 37 | + |
| 38 | +Do NOT pin the CDK CLI and do NOT add a Dependabot `ignore` for these bumps. |
| 39 | +CI runs `cdk synth` with the latest CLI, so the Dependabot PR that bumps |
| 40 | +`aws-cdk-lib` to >= 2.251 (or `cdk-nag` to 3.x) is a live tripwire: |
| 41 | + |
| 42 | +- While the `build-infra` check on that PR is **red**, the upstream gap is still open. |
| 43 | +- When that check goes **green**, the fix has landed. Then: |
| 44 | + 1. bump `aws-cdk-lib` (and optionally `cdk-nag` to 3.x), |
| 45 | + 2. switch the IAM4/IAM5 suppressions in `WorkshopApp` from |
| 46 | + `NagSuppressions` to `Validations.of(stack).acknowledge(...)`, |
| 47 | + 3. delete this note. |
| 48 | + |
| 49 | +### Manual recheck |
| 50 | +On a scratch branch with `aws-cdk-lib >= 2.251` + `cdk-nag` 3.x, confirm that |
| 51 | + |
| 52 | + Validations.of(stack).acknowledge( |
| 53 | + Acknowledgment.builder() |
| 54 | + .id("AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/AdministratorAccess]") |
| 55 | + .reason("...").build()); |
| 56 | + |
| 57 | +no longer throws `InvalidValidationId` and that `cdk synth` exits 0. |
| 58 | + |
| 59 | +## Upstream references |
| 60 | +- aws/aws-cdk#26844 - cdk synth used to return exit 0 despite policy-validation |
| 61 | + failures (fixed in recent CLIs; this is what surfaced the findings). |
| 62 | +- cdk-nag v3 README: prefix / bulk suppression "not yet supported" (tracked upstream). |
| 63 | +- Watch `aws-cdk-lib` release notes for `Validations.acknowledge` id parsing that |
| 64 | + accepts embedded `::`. |
0 commit comments