@mavogel/awscdk-rootmail 0.0.336 → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.codegraph/.gitignore +5 -0
- package/.jsii +460 -8
- package/CLAUDE.md +1 -1
- package/README.md +6 -1
- package/docs/plans/2026-08-09-bump-mvc-projen-cdk-nag-v3.md +199 -0
- package/integ-tests/integ.rootmail-custom-santa.ts +2 -2
- package/integ-tests/integ.rootmail-filter-subject.ts +2 -2
- package/integ-tests/integ.rootmail.ts +2 -2
- package/lib/hosted-zone-dkim-propagation.js +46 -15
- package/lib/hosted-zone-dkim-verification-records.js +47 -12
- package/lib/rootmail-autowire-dns.js +47 -15
- package/lib/rootmail.js +13 -16
- package/lib/ses-receipt-ruleset-activation.js +53 -15
- package/lib/ses-receive.js +12 -12
- package/node_modules/cdk-nag/.jsii +6331 -2945
- package/node_modules/cdk-nag/.jsii.tabl.json +1 -1
- package/node_modules/cdk-nag/API.md +490 -1778
- package/node_modules/cdk-nag/MIGRATION.md +239 -0
- package/node_modules/cdk-nag/README.md +88 -513
- package/node_modules/cdk-nag/lib/index.d.ts +0 -3
- package/node_modules/cdk-nag/lib/index.js +1 -4
- package/node_modules/cdk-nag/lib/nag-logger.d.ts +5 -145
- package/node_modules/cdk-nag/lib/nag-logger.js +4 -199
- package/node_modules/cdk-nag/lib/nag-pack.d.ts +57 -44
- package/node_modules/cdk-nag/lib/nag-pack.js +140 -114
- package/node_modules/cdk-nag/lib/nag-rules.d.ts +0 -2
- package/node_modules/cdk-nag/lib/nag-rules.js +3 -5
- package/node_modules/cdk-nag/lib/packs/aws-solutions.d.ts +4 -15
- package/node_modules/cdk-nag/lib/packs/aws-solutions.js +21 -40
- package/node_modules/cdk-nag/lib/packs/hipaa-security.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/hipaa-security.js +31 -37
- package/node_modules/cdk-nag/lib/packs/nist-800-53-r4.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/nist-800-53-r4.js +29 -35
- package/node_modules/cdk-nag/lib/packs/nist-800-53-r5.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/nist-800-53-r5.js +30 -36
- package/node_modules/cdk-nag/lib/packs/pci-dss-321.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/pci-dss-321.js +29 -35
- package/node_modules/cdk-nag/lib/packs/serverless.d.ts +4 -2
- package/node_modules/cdk-nag/lib/packs/serverless.js +14 -20
- package/node_modules/cdk-nag/lib/rules/ec2/EC2IMDSv2Enabled.js +5 -1
- package/node_modules/cdk-nag/package.json +5 -5
- package/package.json +16 -17
- package/node_modules/cdk-nag/lib/ignore-suppression-conditions.d.ts +0 -59
- package/node_modules/cdk-nag/lib/ignore-suppression-conditions.js +0 -97
- package/node_modules/cdk-nag/lib/models/nag-suppression.d.ts +0 -30
- package/node_modules/cdk-nag/lib/models/nag-suppression.js +0 -7
- package/node_modules/cdk-nag/lib/nag-suppressions.d.ts +0 -30
- package/node_modules/cdk-nag/lib/nag-suppressions.js +0 -96
- package/node_modules/cdk-nag/lib/utils/nag-suppression-helper.d.ts +0 -20
- package/node_modules/cdk-nag/lib/utils/nag-suppression-helper.js +0 -119
|
@@ -1,9 +1,6 @@
|
|
|
1
|
-
export * from './ignore-suppression-conditions';
|
|
2
|
-
export * from './models/nag-suppression';
|
|
3
1
|
export * from './nag-logger';
|
|
4
2
|
export * from './nag-pack';
|
|
5
3
|
export * from './nag-rules';
|
|
6
|
-
export * from './nag-suppressions';
|
|
7
4
|
export * from './packs/aws-solutions';
|
|
8
5
|
export * from './packs/hipaa-security';
|
|
9
6
|
export * from './packs/nist-800-53-r4';
|
|
@@ -19,12 +19,9 @@ exports.rules = void 0;
|
|
|
19
19
|
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
|
20
20
|
SPDX-License-Identifier: Apache-2.0
|
|
21
21
|
*/
|
|
22
|
-
__exportStar(require("./ignore-suppression-conditions"), exports);
|
|
23
|
-
__exportStar(require("./models/nag-suppression"), exports);
|
|
24
22
|
__exportStar(require("./nag-logger"), exports);
|
|
25
23
|
__exportStar(require("./nag-pack"), exports);
|
|
26
24
|
__exportStar(require("./nag-rules"), exports);
|
|
27
|
-
__exportStar(require("./nag-suppressions"), exports);
|
|
28
25
|
__exportStar(require("./packs/aws-solutions"), exports);
|
|
29
26
|
__exportStar(require("./packs/hipaa-security"), exports);
|
|
30
27
|
__exportStar(require("./packs/nist-800-53-r4"), exports);
|
|
@@ -32,4 +29,4 @@ __exportStar(require("./packs/nist-800-53-r5"), exports);
|
|
|
32
29
|
__exportStar(require("./packs/pci-dss-321"), exports);
|
|
33
30
|
__exportStar(require("./packs/serverless"), exports);
|
|
34
31
|
exports.rules = require("./rules");
|
|
35
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
32
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQTs7O0VBR0U7QUFDRiwrQ0FBNkI7QUFDN0IsNkNBQTJCO0FBQzNCLDhDQUE0QjtBQUM1Qix3REFBc0M7QUFDdEMseURBQXVDO0FBQ3ZDLHlEQUF1QztBQUN2Qyx5REFBdUM7QUFDdkMsc0RBQW9DO0FBQ3BDLHFEQUFtQztBQUNuQyxtQ0FBaUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKlxuQ29weXJpZ2h0IEFtYXpvbi5jb20sIEluYy4gb3IgaXRzIGFmZmlsaWF0ZXMuIEFsbCBSaWdodHMgUmVzZXJ2ZWQuXG5TUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuKi9cbmV4cG9ydCAqIGZyb20gJy4vbmFnLWxvZ2dlcic7XG5leHBvcnQgKiBmcm9tICcuL25hZy1wYWNrJztcbmV4cG9ydCAqIGZyb20gJy4vbmFnLXJ1bGVzJztcbmV4cG9ydCAqIGZyb20gJy4vcGFja3MvYXdzLXNvbHV0aW9ucyc7XG5leHBvcnQgKiBmcm9tICcuL3BhY2tzL2hpcGFhLXNlY3VyaXR5JztcbmV4cG9ydCAqIGZyb20gJy4vcGFja3MvbmlzdC04MDAtNTMtcjQnO1xuZXhwb3J0ICogZnJvbSAnLi9wYWNrcy9uaXN0LTgwMC01My1yNSc7XG5leHBvcnQgKiBmcm9tICcuL3BhY2tzL3BjaS1kc3MtMzIxJztcbmV4cG9ydCAqIGZyb20gJy4vcGFja3Mvc2VydmVybGVzcyc7XG5leHBvcnQgKiBhcyBydWxlcyBmcm9tICcuL3J1bGVzJztcbiJdfQ==
|
|
@@ -1,163 +1,23 @@
|
|
|
1
|
-
import { CfnResource } from 'aws-cdk-lib';
|
|
2
|
-
import { NagMessageLevel, NagRuleStates } from './nag-rules';
|
|
3
1
|
/**
|
|
4
|
-
*
|
|
5
|
-
* @param nagPackName The name of the NagPack that the rule belongs to.
|
|
6
|
-
* @param resource The resource the suppression is applied to.
|
|
7
|
-
* @param ruleId The id of the rule to ignore.
|
|
8
|
-
* @param ruleOriginalName Original name of the rule.
|
|
9
|
-
* @param ruleInfo Why the rule was triggered.
|
|
10
|
-
* @param ruleExplanation Why the rule exists.
|
|
11
|
-
* @param ruleLevel The severity level of the rule.
|
|
2
|
+
* Schema for the NagReport output.
|
|
12
3
|
*/
|
|
13
|
-
export interface NagLoggerBaseData {
|
|
14
|
-
readonly nagPackName: string;
|
|
15
|
-
readonly resource: CfnResource;
|
|
16
|
-
readonly ruleId: string;
|
|
17
|
-
readonly ruleOriginalName: string;
|
|
18
|
-
readonly ruleInfo: string;
|
|
19
|
-
readonly ruleExplanation: string;
|
|
20
|
-
readonly ruleLevel: NagMessageLevel;
|
|
21
|
-
}
|
|
22
|
-
/**
|
|
23
|
-
* Data for onCompliance method of an INagLogger.
|
|
24
|
-
*/
|
|
25
|
-
export interface NagLoggerComplianceData extends NagLoggerBaseData {
|
|
26
|
-
}
|
|
27
|
-
/**
|
|
28
|
-
* Data for onNonCompliance method of an INagLogger.
|
|
29
|
-
* @param findingId The id of the finding that is being checked.
|
|
30
|
-
*/
|
|
31
|
-
export interface NagLoggerNonComplianceData extends NagLoggerBaseData {
|
|
32
|
-
readonly findingId: string;
|
|
33
|
-
}
|
|
34
|
-
/**
|
|
35
|
-
* Data for onSuppressed method of an INagLogger.
|
|
36
|
-
* @param suppressionReason The reason given for the suppression.
|
|
37
|
-
*/
|
|
38
|
-
export interface NagLoggerSuppressedData extends NagLoggerNonComplianceData {
|
|
39
|
-
readonly suppressionReason: string;
|
|
40
|
-
}
|
|
41
|
-
/**
|
|
42
|
-
* Data for onError method of an INagLogger.
|
|
43
|
-
* @param errorMessage: The error that was thrown.
|
|
44
|
-
* @param shouldLogIgnored Whether or not the NagPack user has indicated that they want to log suppression details.
|
|
45
|
-
*/
|
|
46
|
-
export interface NagLoggerErrorData extends NagLoggerBaseData {
|
|
47
|
-
readonly errorMessage: string;
|
|
48
|
-
}
|
|
49
|
-
/**
|
|
50
|
-
* Data for onSuppressedError method of an INagLogger.
|
|
51
|
-
* @param errorSuppressionReason The reason given for the validation error suppression.
|
|
52
|
-
*/
|
|
53
|
-
export interface NagLoggerSuppressedErrorData extends NagLoggerErrorData {
|
|
54
|
-
readonly errorSuppressionReason: string;
|
|
55
|
-
}
|
|
56
|
-
/**
|
|
57
|
-
* Data for onNotApplicable method of an INagLogger.
|
|
58
|
-
*/
|
|
59
|
-
export interface NagLoggerNotApplicableData extends NagLoggerBaseData {
|
|
60
|
-
}
|
|
61
|
-
/**
|
|
62
|
-
* Interface for creating NagSuppression Ignores
|
|
63
|
-
*/
|
|
64
|
-
export interface INagLogger {
|
|
65
|
-
/**
|
|
66
|
-
* Called when a CfnResource passes the compliance check for a given rule.
|
|
67
|
-
*/
|
|
68
|
-
onCompliance(data: NagLoggerComplianceData): void;
|
|
69
|
-
/**
|
|
70
|
-
* Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user.
|
|
71
|
-
*/
|
|
72
|
-
onNonCompliance(data: NagLoggerNonComplianceData): void;
|
|
73
|
-
/**
|
|
74
|
-
* Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user.
|
|
75
|
-
*/
|
|
76
|
-
onSuppressed(data: NagLoggerSuppressedData): void;
|
|
77
|
-
/**
|
|
78
|
-
* Called when a rule throws an error during while validating a CfnResource for compliance.
|
|
79
|
-
*/
|
|
80
|
-
onError(data: NagLoggerErrorData): void;
|
|
81
|
-
/**
|
|
82
|
-
* Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed.
|
|
83
|
-
*/
|
|
84
|
-
onSuppressedError(data: NagLoggerSuppressedErrorData): void;
|
|
85
|
-
/**
|
|
86
|
-
* Called when a rule does not apply to the given CfnResource.
|
|
87
|
-
*/
|
|
88
|
-
onNotApplicable(data: NagLoggerNotApplicableData): void;
|
|
89
|
-
}
|
|
90
|
-
/**
|
|
91
|
-
* Props for the AnnotationLogger
|
|
92
|
-
*/
|
|
93
|
-
export interface AnnotationLoggerProps {
|
|
94
|
-
/**
|
|
95
|
-
* Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages.
|
|
96
|
-
*/
|
|
97
|
-
readonly verbose?: boolean;
|
|
98
|
-
/**
|
|
99
|
-
* Whether or not to log suppressed rule violations as informational messages (default: false).
|
|
100
|
-
*/
|
|
101
|
-
readonly logIgnores?: boolean;
|
|
102
|
-
}
|
|
103
|
-
/**
|
|
104
|
-
* A NagLogger that outputs to the CDK Annotations system.
|
|
105
|
-
*/
|
|
106
|
-
export declare class AnnotationLogger implements INagLogger {
|
|
107
|
-
suppressionId: string;
|
|
108
|
-
readonly verbose: boolean;
|
|
109
|
-
readonly logIgnores: boolean;
|
|
110
|
-
constructor(props?: AnnotationLoggerProps);
|
|
111
|
-
onCompliance(_data: NagLoggerComplianceData): void;
|
|
112
|
-
onNonCompliance(data: NagLoggerNonComplianceData): void;
|
|
113
|
-
onSuppressed(data: NagLoggerSuppressedData): void;
|
|
114
|
-
onError(data: NagLoggerErrorData): void;
|
|
115
|
-
onSuppressedError(data: NagLoggerSuppressedErrorData): void;
|
|
116
|
-
onNotApplicable(_data: NagLoggerNotApplicableData): void;
|
|
117
|
-
protected createMessage(ruleId: string, findingId: string, ruleInfo: string, ruleExplanation: string, verbose: boolean): string;
|
|
118
|
-
}
|
|
119
4
|
export interface NagReportSchema {
|
|
120
5
|
readonly lines: NagReportLine[];
|
|
121
6
|
}
|
|
7
|
+
/**
|
|
8
|
+
* A single line in a NagReport.
|
|
9
|
+
*/
|
|
122
10
|
export interface NagReportLine {
|
|
123
11
|
readonly ruleId: string;
|
|
124
12
|
readonly resourceId: string;
|
|
125
13
|
readonly compliance: string;
|
|
126
|
-
readonly exceptionReason: string;
|
|
127
14
|
readonly ruleLevel: string;
|
|
128
15
|
readonly ruleInfo: string;
|
|
129
16
|
}
|
|
130
17
|
/**
|
|
131
|
-
* Possible output formats of the NagReport
|
|
18
|
+
* Possible output formats of the NagReport.
|
|
132
19
|
*/
|
|
133
20
|
export declare enum NagReportFormat {
|
|
134
21
|
CSV = "csv",
|
|
135
22
|
JSON = "json"
|
|
136
23
|
}
|
|
137
|
-
/**
|
|
138
|
-
* Props for the NagReportLogger
|
|
139
|
-
*/
|
|
140
|
-
export interface NagReportLoggerProps {
|
|
141
|
-
readonly formats: NagReportFormat[];
|
|
142
|
-
}
|
|
143
|
-
/**
|
|
144
|
-
* A NagLogger that creates compliance reports
|
|
145
|
-
*/
|
|
146
|
-
export declare class NagReportLogger implements INagLogger {
|
|
147
|
-
private reportStacks;
|
|
148
|
-
readonly formats: NagReportFormat[];
|
|
149
|
-
constructor(props: NagReportLoggerProps);
|
|
150
|
-
onCompliance(data: NagLoggerComplianceData): void;
|
|
151
|
-
onNonCompliance(data: NagLoggerNonComplianceData): void;
|
|
152
|
-
onSuppressed(data: NagLoggerSuppressedData): void;
|
|
153
|
-
onError(data: NagLoggerErrorData): void;
|
|
154
|
-
onSuppressedError(data: NagLoggerSuppressedErrorData): void;
|
|
155
|
-
onNotApplicable(data: NagLoggerNotApplicableData): void;
|
|
156
|
-
getFormatStacks(format: NagReportFormat): string[];
|
|
157
|
-
/**
|
|
158
|
-
* Initialize the report for the rule pack's compliance report for the resource's Stack if it doesn't exist
|
|
159
|
-
* @param data
|
|
160
|
-
*/
|
|
161
|
-
protected initializeStackReport(data: NagLoggerBaseData): void;
|
|
162
|
-
protected writeToStackComplianceReport(data: NagLoggerBaseData, compliance: NagRuleStates): void;
|
|
163
|
-
}
|
|
@@ -1,211 +1,16 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
-
var _a, _b;
|
|
3
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
4
|
-
exports.NagReportLogger = exports.NagReportFormat = exports.AnnotationLogger = void 0;
|
|
5
|
-
const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
|
|
6
2
|
/*
|
|
7
3
|
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
|
8
4
|
SPDX-License-Identifier: Apache-2.0
|
|
9
5
|
*/
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
const aws_cdk_lib_1 = require("aws-cdk-lib");
|
|
13
|
-
const nag_rules_1 = require("./nag-rules");
|
|
14
|
-
/**
|
|
15
|
-
* A NagLogger that outputs to the CDK Annotations system.
|
|
16
|
-
*/
|
|
17
|
-
class AnnotationLogger {
|
|
18
|
-
constructor(props) {
|
|
19
|
-
this.suppressionId = 'CdkNagSuppression';
|
|
20
|
-
this.verbose = props?.verbose ?? false;
|
|
21
|
-
this.logIgnores = props?.logIgnores ?? false;
|
|
22
|
-
}
|
|
23
|
-
onCompliance(_data) {
|
|
24
|
-
return;
|
|
25
|
-
}
|
|
26
|
-
onNonCompliance(data) {
|
|
27
|
-
const message = this.createMessage(data.ruleId, data.findingId, data.ruleInfo, data.ruleExplanation, this.verbose);
|
|
28
|
-
switch (data.ruleLevel) {
|
|
29
|
-
case nag_rules_1.NagMessageLevel.ERROR:
|
|
30
|
-
aws_cdk_lib_1.Annotations.of(data.resource).addError(message);
|
|
31
|
-
break;
|
|
32
|
-
case nag_rules_1.NagMessageLevel.WARN:
|
|
33
|
-
aws_cdk_lib_1.Annotations.of(data.resource).addWarning(message);
|
|
34
|
-
break;
|
|
35
|
-
case nag_rules_1.NagMessageLevel.INFO:
|
|
36
|
-
aws_cdk_lib_1.Annotations.of(data.resource).addInfo(message);
|
|
37
|
-
break;
|
|
38
|
-
default:
|
|
39
|
-
throw new Error(`Unrecognized message level ${data.ruleLevel} for the AnnotationLogger`);
|
|
40
|
-
}
|
|
41
|
-
}
|
|
42
|
-
onSuppressed(data) {
|
|
43
|
-
if (this.logIgnores) {
|
|
44
|
-
const message = this.createMessage(this.suppressionId, data.findingId, `${data.ruleId} was triggered but suppressed.`, `Provided reason: "${data.suppressionReason}"`, this.verbose);
|
|
45
|
-
aws_cdk_lib_1.Annotations.of(data.resource).addInfo(message);
|
|
46
|
-
}
|
|
47
|
-
}
|
|
48
|
-
onError(data) {
|
|
49
|
-
const information = `'${data.ruleId}' threw an error during validation. This is generally caused by a parameter referencing an intrinsic function. You can suppress the "${nag_rules_1.VALIDATION_FAILURE_ID}" to get rid of this error. For more details enable verbose logging.'`;
|
|
50
|
-
const message = this.createMessage(nag_rules_1.VALIDATION_FAILURE_ID, data.ruleId, information, data.errorMessage, this.verbose);
|
|
51
|
-
aws_cdk_lib_1.Annotations.of(data.resource).addWarning(message);
|
|
52
|
-
}
|
|
53
|
-
onSuppressedError(data) {
|
|
54
|
-
if (this.logIgnores === true) {
|
|
55
|
-
const message = this.createMessage(this.suppressionId, data.ruleId, `${nag_rules_1.VALIDATION_FAILURE_ID} was triggered but suppressed.`, data.errorSuppressionReason, this.verbose);
|
|
56
|
-
aws_cdk_lib_1.Annotations.of(data.resource).addInfo(message);
|
|
57
|
-
}
|
|
58
|
-
}
|
|
59
|
-
onNotApplicable(_data) {
|
|
60
|
-
return;
|
|
61
|
-
}
|
|
62
|
-
createMessage(ruleId, findingId, ruleInfo, ruleExplanation, verbose) {
|
|
63
|
-
let message = findingId
|
|
64
|
-
? `${ruleId}[${findingId}]: ${ruleInfo}`
|
|
65
|
-
: `${ruleId}: ${ruleInfo}`;
|
|
66
|
-
return verbose ? `${message} ${ruleExplanation}\n` : `${message}\n`;
|
|
67
|
-
}
|
|
68
|
-
}
|
|
69
|
-
exports.AnnotationLogger = AnnotationLogger;
|
|
70
|
-
_a = JSII_RTTI_SYMBOL_1;
|
|
71
|
-
AnnotationLogger[_a] = { fqn: "cdk-nag.AnnotationLogger", version: "2.38.2" };
|
|
6
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
7
|
+
exports.NagReportFormat = void 0;
|
|
72
8
|
/**
|
|
73
|
-
* Possible output formats of the NagReport
|
|
9
|
+
* Possible output formats of the NagReport.
|
|
74
10
|
*/
|
|
75
11
|
var NagReportFormat;
|
|
76
12
|
(function (NagReportFormat) {
|
|
77
13
|
NagReportFormat["CSV"] = "csv";
|
|
78
14
|
NagReportFormat["JSON"] = "json";
|
|
79
15
|
})(NagReportFormat || (exports.NagReportFormat = NagReportFormat = {}));
|
|
80
|
-
|
|
81
|
-
* A NagLogger that creates compliance reports
|
|
82
|
-
*/
|
|
83
|
-
class NagReportLogger {
|
|
84
|
-
constructor(props) {
|
|
85
|
-
this.reportStacks = new Map();
|
|
86
|
-
if (props.formats.length === 0) {
|
|
87
|
-
throw new Error('Must provide at least 1 NagReportFormat.');
|
|
88
|
-
}
|
|
89
|
-
this.formats = props.formats;
|
|
90
|
-
}
|
|
91
|
-
onCompliance(data) {
|
|
92
|
-
this.initializeStackReport(data);
|
|
93
|
-
this.writeToStackComplianceReport(data, nag_rules_1.NagRuleCompliance.COMPLIANT);
|
|
94
|
-
}
|
|
95
|
-
onNonCompliance(data) {
|
|
96
|
-
this.initializeStackReport(data);
|
|
97
|
-
this.writeToStackComplianceReport(data, nag_rules_1.NagRuleCompliance.NON_COMPLIANT);
|
|
98
|
-
}
|
|
99
|
-
onSuppressed(data) {
|
|
100
|
-
this.initializeStackReport(data);
|
|
101
|
-
this.writeToStackComplianceReport(data, nag_rules_1.NagRulePostValidationStates.SUPPRESSED);
|
|
102
|
-
}
|
|
103
|
-
onError(data) {
|
|
104
|
-
this.initializeStackReport(data);
|
|
105
|
-
this.writeToStackComplianceReport(data, nag_rules_1.NagRulePostValidationStates.UNKNOWN);
|
|
106
|
-
}
|
|
107
|
-
onSuppressedError(data) {
|
|
108
|
-
this.initializeStackReport(data);
|
|
109
|
-
this.writeToStackComplianceReport(data, nag_rules_1.NagRulePostValidationStates.SUPPRESSED);
|
|
110
|
-
}
|
|
111
|
-
onNotApplicable(data) {
|
|
112
|
-
this.initializeStackReport(data);
|
|
113
|
-
}
|
|
114
|
-
getFormatStacks(format) {
|
|
115
|
-
return this.reportStacks.get(format) ?? [];
|
|
116
|
-
}
|
|
117
|
-
/**
|
|
118
|
-
* Initialize the report for the rule pack's compliance report for the resource's Stack if it doesn't exist
|
|
119
|
-
* @param data
|
|
120
|
-
*/
|
|
121
|
-
initializeStackReport(data) {
|
|
122
|
-
for (const format of this.formats) {
|
|
123
|
-
const assembly = aws_cdk_lib_1.Stage.of(data.resource.stack);
|
|
124
|
-
const prefix = assembly ? `${assembly.node.id}-` : '';
|
|
125
|
-
const stackName = data.resource.stack.nested
|
|
126
|
-
? aws_cdk_lib_1.Names.uniqueId(data.resource.stack)
|
|
127
|
-
: data.resource.stack.stackName;
|
|
128
|
-
const fileName = `${data.nagPackName}-${prefix}${stackName}-NagReport.${format}`;
|
|
129
|
-
const stacks = this.getFormatStacks(format);
|
|
130
|
-
if (!stacks.includes(fileName)) {
|
|
131
|
-
const filePath = (0, path_1.join)(aws_cdk_lib_1.App.of(data.resource)?.outdir ?? '', fileName);
|
|
132
|
-
this.reportStacks.set(format, [...stacks, fileName]);
|
|
133
|
-
let body = '';
|
|
134
|
-
if (format === NagReportFormat.CSV) {
|
|
135
|
-
body =
|
|
136
|
-
'Rule ID,Resource ID,Compliance,Exception Reason,Rule Level,Rule Info\n';
|
|
137
|
-
}
|
|
138
|
-
else if (format === NagReportFormat.JSON) {
|
|
139
|
-
body = JSON.stringify({ lines: [] });
|
|
140
|
-
}
|
|
141
|
-
else {
|
|
142
|
-
throw new Error(`Unrecognized output format ${format} for the NagReportLogger`);
|
|
143
|
-
}
|
|
144
|
-
(0, fs_1.writeFileSync)(filePath, body);
|
|
145
|
-
}
|
|
146
|
-
}
|
|
147
|
-
}
|
|
148
|
-
writeToStackComplianceReport(data, compliance) {
|
|
149
|
-
for (const format of this.formats) {
|
|
150
|
-
const assembly = aws_cdk_lib_1.Stage.of(data.resource.stack);
|
|
151
|
-
const prefix = assembly ? `${assembly.node.id}-` : '';
|
|
152
|
-
const stackName = data.resource.stack.nested
|
|
153
|
-
? aws_cdk_lib_1.Names.uniqueId(data.resource.stack)
|
|
154
|
-
: data.resource.stack.stackName;
|
|
155
|
-
const fileName = `${data.nagPackName}-${prefix}${stackName}-NagReport.${format}`;
|
|
156
|
-
const filePath = (0, path_1.join)(aws_cdk_lib_1.App.of(data.resource)?.outdir ?? '', fileName);
|
|
157
|
-
if (format === NagReportFormat.CSV) {
|
|
158
|
-
//| Rule ID | Resource ID | Compliance | Exception Reason | Rule Level | Rule Info
|
|
159
|
-
const line = Array();
|
|
160
|
-
line.push(data.ruleId);
|
|
161
|
-
line.push(data.resource.node.path);
|
|
162
|
-
if (compliance === nag_rules_1.NagRulePostValidationStates.SUPPRESSED) {
|
|
163
|
-
line.push(nag_rules_1.NagRulePostValidationStates.SUPPRESSED);
|
|
164
|
-
if (data.suppressionReason !== undefined) {
|
|
165
|
-
line.push(data.suppressionReason);
|
|
166
|
-
}
|
|
167
|
-
else {
|
|
168
|
-
line.push(data.errorSuppressionReason);
|
|
169
|
-
}
|
|
170
|
-
}
|
|
171
|
-
else {
|
|
172
|
-
line.push(compliance);
|
|
173
|
-
line.push('N/A');
|
|
174
|
-
}
|
|
175
|
-
line.push(data.ruleLevel);
|
|
176
|
-
line.push(data.ruleInfo);
|
|
177
|
-
(0, fs_1.appendFileSync)(filePath, line.map((i) => '"' + i.replace(/"/g, '""') + '"').join(',') + '\n');
|
|
178
|
-
}
|
|
179
|
-
else if (format === NagReportFormat.JSON) {
|
|
180
|
-
const report = JSON.parse((0, fs_1.readFileSync)(filePath, 'utf8'));
|
|
181
|
-
let exceptionReason = 'N/A';
|
|
182
|
-
if (compliance === nag_rules_1.NagRulePostValidationStates.SUPPRESSED) {
|
|
183
|
-
if (data.suppressionReason !== undefined) {
|
|
184
|
-
exceptionReason = data
|
|
185
|
-
.suppressionReason;
|
|
186
|
-
}
|
|
187
|
-
else {
|
|
188
|
-
exceptionReason = data
|
|
189
|
-
.errorSuppressionReason;
|
|
190
|
-
}
|
|
191
|
-
}
|
|
192
|
-
report.lines.push({
|
|
193
|
-
ruleId: data.ruleId,
|
|
194
|
-
resourceId: data.resource.node.path,
|
|
195
|
-
compliance,
|
|
196
|
-
exceptionReason,
|
|
197
|
-
ruleLevel: data.ruleLevel,
|
|
198
|
-
ruleInfo: data.ruleInfo,
|
|
199
|
-
});
|
|
200
|
-
(0, fs_1.writeFileSync)(filePath, JSON.stringify(report));
|
|
201
|
-
}
|
|
202
|
-
else {
|
|
203
|
-
throw new Error(`Unrecognized output format ${format} for the NagReportLogger`);
|
|
204
|
-
}
|
|
205
|
-
}
|
|
206
|
-
}
|
|
207
|
-
}
|
|
208
|
-
exports.NagReportLogger = NagReportLogger;
|
|
209
|
-
_b = JSII_RTTI_SYMBOL_1;
|
|
210
|
-
NagReportLogger[_b] = { fqn: "cdk-nag.NagReportLogger", version: "2.38.2" };
|
|
211
|
-
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFnLWxvZ2dlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9uYWctbG9nZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUE7OztFQUdFO0FBQ0YsMkJBQWlFO0FBQ2pFLCtCQUE0QjtBQUM1Qiw2Q0FBMEU7QUFDMUUsMkNBTXFCO0FBeUdyQjs7R0FFRztBQUNILE1BQWEsZ0JBQWdCO0lBSTNCLFlBQVksS0FBNkI7UUFIekMsa0JBQWEsR0FBRyxtQkFBbUIsQ0FBQztRQUlsQyxJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssRUFBRSxPQUFPLElBQUksS0FBSyxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxVQUFVLEdBQUcsS0FBSyxFQUFFLFVBQVUsSUFBSSxLQUFLLENBQUM7SUFDL0MsQ0FBQztJQUNELFlBQVksQ0FBQyxLQUE4QjtRQUN6QyxPQUFPO0lBQ1QsQ0FBQztJQUNELGVBQWUsQ0FBQyxJQUFnQztRQUM5QyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsYUFBYSxDQUNoQyxJQUFJLENBQUMsTUFBTSxFQUNYLElBQUksQ0FBQyxTQUFTLEVBQ2QsSUFBSSxDQUFDLFFBQVEsRUFDYixJQUFJLENBQUMsZUFBZSxFQUNwQixJQUFJLENBQUMsT0FBTyxDQUNiLENBQUM7UUFDRixRQUFRLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUN2QixLQUFLLDJCQUFlLENBQUMsS0FBSztnQkFDeEIseUJBQVcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDaEQsTUFBTTtZQUNSLEtBQUssMkJBQWUsQ0FBQyxJQUFJO2dCQUN2Qix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUNsRCxNQUFNO1lBQ1IsS0FBSywyQkFBZSxDQUFDLElBQUk7Z0JBQ3ZCLHlCQUFXLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7Z0JBQy9DLE1BQU07WUFDUjtnQkFDRSxNQUFNLElBQUksS0FBSyxDQUNiLDhCQUE4QixJQUFJLENBQUMsU0FBUywyQkFBMkIsQ0FDeEUsQ0FBQztRQUNOLENBQUM7SUFDSCxDQUFDO0lBQ0QsWUFBWSxDQUFDLElBQTZCO1FBQ3hDLElBQUksSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3BCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxhQUFhLENBQ2hDLElBQUksQ0FBQyxhQUFhLEVBQ2xCLElBQUksQ0FBQyxTQUFTLEVBQ2QsR0FBRyxJQUFJLENBQUMsTUFBTSxnQ0FBZ0MsRUFDOUMscUJBQXFCLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxFQUM5QyxJQUFJLENBQUMsT0FBTyxDQUNiLENBQUM7WUFDRix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2pELENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxDQUFDLElBQXdCO1FBQzlCLE1BQU0sV0FBVyxHQUFHLElBQUksSUFBSSxDQUFDLE1BQU0sd0lBQXdJLGlDQUFxQix1RUFBdUUsQ0FBQztRQUN4USxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsYUFBYSxDQUNoQyxpQ0FBcUIsRUFDckIsSUFBSSxDQUFDLE1BQU0sRUFDWCxXQUFXLEVBQ1gsSUFBSSxDQUFDLFlBQVksRUFDakIsSUFBSSxDQUFDLE9BQU8sQ0FDYixDQUFDO1FBQ0YseUJBQVcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBQ0QsaUJBQWlCLENBQUMsSUFBa0M7UUFDbEQsSUFBSSxJQUFJLENBQUMsVUFBVSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQzdCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxhQUFhLENBQ2hDLElBQUksQ0FBQyxhQUFhLEVBQ2xCLElBQUksQ0FBQyxNQUFNLEVBQ1gsR0FBRyxpQ0FBcUIsZ0NBQWdDLEVBQ3hELElBQUksQ0FBQyxzQkFBc0IsRUFDM0IsSUFBSSxDQUFDLE9BQU8sQ0FDYixDQUFDO1lBQ0YseUJBQVcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNqRCxDQUFDO0lBQ0gsQ0FBQztJQUNELGVBQWUsQ0FBQyxLQUFpQztRQUMvQyxPQUFPO0lBQ1QsQ0FBQztJQUVTLGFBQWEsQ0FDckIsTUFBYyxFQUNkLFNBQWlCLEVBQ2pCLFFBQWdCLEVBQ2hCLGVBQXVCLEVBQ3ZCLE9BQWdCO1FBRWhCLElBQUksT0FBTyxHQUFHLFNBQVM7WUFDckIsQ0FBQyxDQUFDLEdBQUcsTUFBTSxJQUFJLFNBQVMsTUFBTSxRQUFRLEVBQUU7WUFDeEMsQ0FBQyxDQUFDLEdBQUcsTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzdCLE9BQU8sT0FBTyxDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8sSUFBSSxlQUFlLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLElBQUksQ0FBQztJQUN0RSxDQUFDOztBQXJGSCw0Q0FzRkM7OztBQWVEOztHQUVHO0FBQ0gsSUFBWSxlQUdYO0FBSEQsV0FBWSxlQUFlO0lBQ3pCLDhCQUFXLENBQUE7SUFDWCxnQ0FBYSxDQUFBO0FBQ2YsQ0FBQyxFQUhXLGVBQWUsK0JBQWYsZUFBZSxRQUcxQjtBQVNEOztHQUVHO0FBQ0gsTUFBYSxlQUFlO0lBRzFCLFlBQVksS0FBMkI7UUFGL0IsaUJBQVksR0FBRyxJQUFJLEdBQUcsRUFBa0MsQ0FBQztRQUcvRCxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQy9CLE1BQU0sSUFBSSxLQUFLLENBQUMsMENBQTBDLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDO0lBQy9CLENBQUM7SUFFRCxZQUFZLENBQUMsSUFBNkI7UUFDeEMsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2pDLElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxJQUFJLEVBQUUsNkJBQWlCLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELGVBQWUsQ0FBQyxJQUFnQztRQUM5QyxJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDakMsSUFBSSxDQUFDLDRCQUE0QixDQUFDLElBQUksRUFBRSw2QkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsWUFBWSxDQUFDLElBQTZCO1FBQ3hDLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNqQyxJQUFJLENBQUMsNEJBQTRCLENBQy9CLElBQUksRUFDSix1Q0FBMkIsQ0FBQyxVQUFVLENBQ3ZDLENBQUM7SUFDSixDQUFDO0lBQ0QsT0FBTyxDQUFDLElBQXdCO1FBQzlCLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNqQyxJQUFJLENBQUMsNEJBQTRCLENBQy9CLElBQUksRUFDSix1Q0FBMkIsQ0FBQyxPQUFPLENBQ3BDLENBQUM7SUFDSixDQUFDO0lBQ0QsaUJBQWlCLENBQUMsSUFBa0M7UUFDbEQsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2pDLElBQUksQ0FBQyw0QkFBNEIsQ0FDL0IsSUFBSSxFQUNKLHVDQUEyQixDQUFDLFVBQVUsQ0FDdkMsQ0FBQztJQUNKLENBQUM7SUFDRCxlQUFlLENBQUMsSUFBZ0M7UUFDOUMsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ25DLENBQUM7SUFFTSxlQUFlLENBQUMsTUFBdUI7UUFDNUMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDN0MsQ0FBQztJQUVEOzs7T0FHRztJQUNPLHFCQUFxQixDQUFDLElBQXVCO1FBQ3JELEtBQUssTUFBTSxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2xDLE1BQU0sUUFBUSxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDL0MsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLENBQUMsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxNQUFNO2dCQUMxQyxDQUFDLENBQUMsbUJBQUssQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7Z0JBQ3JDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7WUFDbEMsTUFBTSxRQUFRLEdBQUcsR0FBRyxJQUFJLENBQUMsV0FBVyxJQUFJLE1BQU0sR0FBRyxTQUFTLGNBQWMsTUFBTSxFQUFFLENBQUM7WUFDakYsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUM1QyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO2dCQUMvQixNQUFNLFFBQVEsR0FBRyxJQUFBLFdBQUksRUFBQyxpQkFBRyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsTUFBTSxJQUFJLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDckUsSUFBSSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztnQkFDckQsSUFBSSxJQUFJLEdBQUcsRUFBRSxDQUFDO2dCQUNkLElBQUksTUFBTSxLQUFLLGVBQWUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztvQkFDbkMsSUFBSTt3QkFDRix3RUFBd0UsQ0FBQztnQkFDN0UsQ0FBQztxQkFBTSxJQUFJLE1BQU0sS0FBSyxlQUFlLENBQUMsSUFBSSxFQUFFLENBQUM7b0JBQzNDLElBQUksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBcUIsQ0FBQyxDQUFDO2dCQUMxRCxDQUFDO3FCQUFNLENBQUM7b0JBQ04sTUFBTSxJQUFJLEtBQUssQ0FDYiw4QkFBOEIsTUFBTSwwQkFBMEIsQ0FDL0QsQ0FBQztnQkFDSixDQUFDO2dCQUNELElBQUEsa0JBQWEsRUFBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDaEMsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRVMsNEJBQTRCLENBQ3BDLElBQXVCLEVBQ3ZCLFVBQXlCO1FBRXpCLEtBQUssTUFBTSxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2xDLE1BQU0sUUFBUSxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDL0MsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLENBQUMsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxNQUFNO2dCQUMxQyxDQUFDLENBQUMsbUJBQUssQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7Z0JBQ3JDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7WUFDbEMsTUFBTSxRQUFRLEdBQUcsR0FBRyxJQUFJLENBQUMsV0FBVyxJQUFJLE1BQU0sR0FBRyxTQUFTLGNBQWMsTUFBTSxFQUFFLENBQUM7WUFDakYsTUFBTSxRQUFRLEdBQUcsSUFBQSxXQUFJLEVBQUMsaUJBQUcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLE1BQU0sSUFBSSxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDckUsSUFBSSxNQUFNLEtBQUssZUFBZSxDQUFDLEdBQUcsRUFBRSxDQUFDO2dCQUNuQyxrRkFBa0Y7Z0JBQ2xGLE1BQU0sSUFBSSxHQUFHLEtBQUssRUFBVSxDQUFDO2dCQUM3QixJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztnQkFDbkMsSUFBSSxVQUFVLEtBQUssdUNBQTJCLENBQUMsVUFBVSxFQUFFLENBQUM7b0JBQzFELElBQUksQ0FBQyxJQUFJLENBQUMsdUNBQTJCLENBQUMsVUFBVSxDQUFDLENBQUM7b0JBQ2xELElBQ0csSUFBZ0MsQ0FBQyxpQkFBaUIsS0FBSyxTQUFTLEVBQ2pFLENBQUM7d0JBQ0QsSUFBSSxDQUFDLElBQUksQ0FBRSxJQUFnQyxDQUFDLGlCQUFpQixDQUFDLENBQUM7b0JBQ2pFLENBQUM7eUJBQU0sQ0FBQzt3QkFDTixJQUFJLENBQUMsSUFBSSxDQUNOLElBQXFDLENBQUMsc0JBQXNCLENBQzlELENBQUM7b0JBQ0osQ0FBQztnQkFDSCxDQUFDO3FCQUFNLENBQUM7b0JBQ04sSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztvQkFDdEIsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDbkIsQ0FBQztnQkFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDMUIsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7Z0JBQ3pCLElBQUEsbUJBQWMsRUFDWixRQUFRLEVBQ1IsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQ3BFLENBQUM7WUFDSixDQUFDO2lCQUFNLElBQUksTUFBTSxLQUFLLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDM0MsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FDdkIsSUFBQSxpQkFBWSxFQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FDWixDQUFDO2dCQUNyQixJQUFJLGVBQWUsR0FBRyxLQUFLLENBQUM7Z0JBQzVCLElBQUksVUFBVSxLQUFLLHVDQUEyQixDQUFDLFVBQVUsRUFBRSxDQUFDO29CQUMxRCxJQUNHLElBQWdDLENBQUMsaUJBQWlCLEtBQUssU0FBUyxFQUNqRSxDQUFDO3dCQUNELGVBQWUsR0FBSSxJQUFnQzs2QkFDaEQsaUJBQWlCLENBQUM7b0JBQ3ZCLENBQUM7eUJBQU0sQ0FBQzt3QkFDTixlQUFlLEdBQUksSUFBcUM7NkJBQ3JELHNCQUFzQixDQUFDO29CQUM1QixDQUFDO2dCQUNILENBQUM7Z0JBQ0QsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7b0JBQ2hCLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtvQkFDbkIsVUFBVSxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUk7b0JBQ25DLFVBQVU7b0JBQ1YsZUFBZTtvQkFDZixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7b0JBQ3pCLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUTtpQkFDeEIsQ0FBQyxDQUFDO2dCQUNILElBQUEsa0JBQWEsRUFBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBQ2xELENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLElBQUksS0FBSyxDQUNiLDhCQUE4QixNQUFNLDBCQUEwQixDQUMvRCxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDOztBQXBKSCwwQ0FxSkMiLCJzb3VyY2VzQ29udGVudCI6WyIvKlxuQ29weXJpZ2h0IEFtYXpvbi5jb20sIEluYy4gb3IgaXRzIGFmZmlsaWF0ZXMuIEFsbCBSaWdodHMgUmVzZXJ2ZWQuXG5TUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuKi9cbmltcG9ydCB7IGFwcGVuZEZpbGVTeW5jLCByZWFkRmlsZVN5bmMsIHdyaXRlRmlsZVN5bmMgfSBmcm9tICdmcyc7XG5pbXBvcnQgeyBqb2luIH0gZnJvbSAncGF0aCc7XG5pbXBvcnQgeyBBbm5vdGF0aW9ucywgQXBwLCBDZm5SZXNvdXJjZSwgTmFtZXMsIFN0YWdlIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHtcbiAgTmFnTWVzc2FnZUxldmVsLFxuICBOYWdSdWxlQ29tcGxpYW5jZSxcbiAgTmFnUnVsZVBvc3RWYWxpZGF0aW9uU3RhdGVzLFxuICBOYWdSdWxlU3RhdGVzLFxuICBWQUxJREFUSU9OX0ZBSUxVUkVfSUQsXG59IGZyb20gJy4vbmFnLXJ1bGVzJztcblxuLyoqXG4gKiBTaGFyZWQgZGF0YSBmb3IgYWxsIElOYWdMb2dnZXIgbWV0aG9kc1xuICogQHBhcmFtIG5hZ1BhY2tOYW1lIFRoZSBuYW1lIG9mIHRoZSBOYWdQYWNrIHRoYXQgdGhlIHJ1bGUgYmVsb25ncyB0by5cbiAqIEBwYXJhbSByZXNvdXJjZSBUaGUgcmVzb3VyY2UgdGhlIHN1cHByZXNzaW9uIGlzIGFwcGxpZWQgdG8uXG4gKiBAcGFyYW0gcnVsZUlkIFRoZSBpZCBvZiB0aGUgcnVsZSB0byBpZ25vcmUuXG4gKiBAcGFyYW0gcnVsZU9yaWdpbmFsTmFtZSBPcmlnaW5hbCBuYW1lIG9mIHRoZSBydWxlLlxuICogQHBhcmFtIHJ1bGVJbmZvIFdoeSB0aGUgcnVsZSB3YXMgdHJpZ2dlcmVkLlxuICogQHBhcmFtIHJ1bGVFeHBsYW5hdGlvbiBXaHkgdGhlIHJ1bGUgZXhpc3RzLlxuICogQHBhcmFtIHJ1bGVMZXZlbCBUaGUgc2V2ZXJpdHkgbGV2ZWwgb2YgdGhlIHJ1bGUuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgTmFnTG9nZ2VyQmFzZURhdGEge1xuICByZWFkb25seSBuYWdQYWNrTmFtZTogc3RyaW5nO1xuICByZWFkb25seSByZXNvdXJjZTogQ2ZuUmVzb3VyY2U7XG4gIHJlYWRvbmx5IHJ1bGVJZDogc3RyaW5nO1xuICByZWFkb25seSBydWxlT3JpZ2luYWxOYW1lOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHJ1bGVJbmZvOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHJ1bGVFeHBsYW5hdGlvbjogc3RyaW5nO1xuICByZWFkb25seSBydWxlTGV2ZWw6IE5hZ01lc3NhZ2VMZXZlbDtcbn1cblxuLyoqXG4gKiBEYXRhIGZvciBvbkNvbXBsaWFuY2UgbWV0aG9kIG9mIGFuIElOYWdMb2dnZXIuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgTmFnTG9nZ2VyQ29tcGxpYW5jZURhdGEgZXh0ZW5kcyBOYWdMb2dnZXJCYXNlRGF0YSB7fVxuLyoqXG4gKiBEYXRhIGZvciBvbk5vbkNvbXBsaWFuY2UgbWV0aG9kIG9mIGFuIElOYWdMb2dnZXIuXG4gKiBAcGFyYW0gZmluZGluZ0lkIFRoZSBpZCBvZiB0aGUgZmluZGluZyB0aGF0IGlzIGJlaW5nIGNoZWNrZWQuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgTmFnTG9nZ2VyTm9uQ29tcGxpYW5jZURhdGEgZXh0ZW5kcyBOYWdMb2dnZXJCYXNlRGF0YSB7XG4gIHJlYWRvbmx5IGZpbmRpbmdJZDogc3RyaW5nO1xufVxuLyoqXG4gKiBEYXRhIGZvciBvblN1cHByZXNzZWQgbWV0aG9kIG9mIGFuIElOYWdMb2dnZXIuXG4gKiBAcGFyYW0gc3VwcHJlc3Npb25SZWFzb24gVGhlIHJlYXNvbiBnaXZlbiBmb3IgdGhlIHN1cHByZXNzaW9uLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIE5hZ0xvZ2dlclN1cHByZXNzZWREYXRhIGV4dGVuZHMgTmFnTG9nZ2VyTm9uQ29tcGxpYW5jZURhdGEge1xuICByZWFkb25seSBzdXBwcmVzc2lvblJlYXNvbjogc3RyaW5nO1xufVxuLyoqXG4gKiBEYXRhIGZvciBvbkVycm9yIG1ldGhvZCBvZiBhbiBJTmFnTG9nZ2VyLlxuICogQHBhcmFtIGVycm9yTWVzc2FnZTogVGhlIGVycm9yIHRoYXQgd2FzIHRocm93bi5cbiAqIEBwYXJhbSBzaG91bGRMb2dJZ25vcmVkIFdoZXRoZXIgb3Igbm90IHRoZSBOYWdQYWNrIHVzZXIgaGFzIGluZGljYXRlZCB0aGF0IHRoZXkgd2FudCB0byBsb2cgc3VwcHJlc3Npb24gZGV0YWlscy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBOYWdMb2dnZXJFcnJvckRhdGEgZXh0ZW5kcyBOYWdMb2dnZXJCYXNlRGF0YSB7XG4gIHJlYWRvbmx5IGVycm9yTWVzc2FnZTogc3RyaW5nO1xufVxuLyoqXG4gKiBEYXRhIGZvciBvblN1cHByZXNzZWRFcnJvciBtZXRob2Qgb2YgYW4gSU5hZ0xvZ2dlci5cbiAqIEBwYXJhbSBlcnJvclN1cHByZXNzaW9uUmVhc29uIFRoZSByZWFzb24gZ2l2ZW4gZm9yIHRoZSB2YWxpZGF0aW9uIGVycm9yIHN1cHByZXNzaW9uLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIE5hZ0xvZ2dlclN1cHByZXNzZWRFcnJvckRhdGEgZXh0ZW5kcyBOYWdMb2dnZXJFcnJvckRhdGEge1xuICByZWFkb25seSBlcnJvclN1cHByZXNzaW9uUmVhc29uOiBzdHJpbmc7XG59XG5cbi8qKlxuICogRGF0YSBmb3Igb25Ob3RBcHBsaWNhYmxlIG1ldGhvZCBvZiBhbiBJTmFnTG9nZ2VyLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIE5hZ0xvZ2dlck5vdEFwcGxpY2FibGVEYXRhIGV4dGVuZHMgTmFnTG9nZ2VyQmFzZURhdGEge31cblxuLyoqXG4gKiBJbnRlcmZhY2UgZm9yIGNyZWF0aW5nIE5hZ1N1cHByZXNzaW9uIElnbm9yZXNcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJTmFnTG9nZ2VyIHtcbiAgLyoqXG4gICAqIENhbGxlZCB3aGVuIGEgQ2ZuUmVzb3VyY2UgcGFzc2VzIHRoZSBjb21wbGlhbmNlIGNoZWNrIGZvciBhIGdpdmVuIHJ1bGUuXG4gICAqL1xuICBvbkNvbXBsaWFuY2UoZGF0YTogTmFnTG9nZ2VyQ29tcGxpYW5jZURhdGEpOiB2b2lkO1xuICAvKipcbiAgICogQ2FsbGVkIHdoZW4gYSBDZm5SZXNvdXJjZSBkb2VzIG5vdCBwYXNzIHRoZSBjb21wbGlhbmNlIGNoZWNrIGZvciBhIGdpdmVuIHJ1bGUgYW5kIHRoZSB0aGUgcnVsZSB2aW9sYXRpb24gaXMgbm90IHN1cHByZXNzZWQgYnkgdGhlIHVzZXIuXG4gICAqL1xuICBvbk5vbkNvbXBsaWFuY2UoZGF0YTogTmFnTG9nZ2VyTm9uQ29tcGxpYW5jZURhdGEpOiB2b2lkO1xuICAvKipcbiAgICogQ2FsbGVkIHdoZW4gYSBDZm5SZXNvdXJjZSBkb2VzIG5vdCBwYXNzIHRoZSBjb21wbGlhbmNlIGNoZWNrIGZvciBhIGdpdmVuIHJ1bGUgYW5kIHRoZSBydWxlIHZpb2xhdGlvbiBpcyBzdXBwcmVzc2VkIGJ5IHRoZSB1c2VyLlxuICAgKi9cbiAgb25TdXBwcmVzc2VkKGRhdGE6IE5hZ0xvZ2dlclN1cHByZXNzZWREYXRhKTogdm9pZDtcbiAgLyoqXG4gICAqIENhbGxlZCB3aGVuIGEgcnVsZSB0aHJvd3MgYW4gZXJyb3IgZHVyaW5nIHdoaWxlIHZhbGlkYXRpbmcgYSBDZm5SZXNvdXJjZSBmb3IgY29tcGxpYW5jZS5cbiAgICovXG4gIG9uRXJyb3IoZGF0YTogTmFnTG9nZ2VyRXJyb3JEYXRhKTogdm9pZDtcbiAgLyoqXG4gICAqIENhbGxlZCB3aGVuIGEgcnVsZSB0aHJvd3MgYW4gZXJyb3IgZHVyaW5nIHdoaWxlIHZhbGlkYXRpbmcgYSBDZm5SZXNvdXJjZSBmb3IgY29tcGxpYW5jZSBhbmQgdGhlIGVycm9yIGlzIHN1cHByZXNzZWQuXG4gICAqL1xuICBvblN1cHByZXNzZWRFcnJvcihkYXRhOiBOYWdMb2dnZXJTdXBwcmVzc2VkRXJyb3JEYXRhKTogdm9pZDtcbiAgLyoqXG4gICAqIENhbGxlZCB3aGVuIGEgcnVsZSBkb2VzIG5vdCBhcHBseSB0byB0aGUgZ2l2ZW4gQ2ZuUmVzb3VyY2UuXG4gICAqL1xuICBvbk5vdEFwcGxpY2FibGUoZGF0YTogTmFnTG9nZ2VyTm90QXBwbGljYWJsZURhdGEpOiB2b2lkO1xufVxuXG4vKipcbiAqIFByb3BzIGZvciB0aGUgQW5ub3RhdGlvbkxvZ2dlclxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFubm90YXRpb25Mb2dnZXJQcm9wcyB7XG4gIC8qKlxuICAgKiBXaGV0aGVyIG9yIG5vdCB0byBlbmFibGUgZXh0ZW5kZWQgZXhwbGFuYXRvcnkgZGVzY3JpcHRpb25zIG9uIHdhcm5pbmcsIGVycm9yLCBhbmQgbG9nZ2VkIGlnbm9yZSBtZXNzYWdlcy5cbiAgICovXG4gIHJlYWRvbmx5IHZlcmJvc2U/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBXaGV0aGVyIG9yIG5vdCB0byBsb2cgc3VwcHJlc3NlZCBydWxlIHZpb2xhdGlvbnMgYXMgaW5mb3JtYXRpb25hbCBtZXNzYWdlcyAoZGVmYXVsdDogZmFsc2UpLlxuICAgKi9cbiAgcmVhZG9ubHkgbG9nSWdub3Jlcz86IGJvb2xlYW47XG59XG4vKipcbiAqIEEgTmFnTG9nZ2VyIHRoYXQgb3V0cHV0cyB0byB0aGUgQ0RLIEFubm90YXRpb25zIHN5c3RlbS5cbiAqL1xuZXhwb3J0IGNsYXNzIEFubm90YXRpb25Mb2dnZXIgaW1wbGVtZW50cyBJTmFnTG9nZ2VyIHtcbiAgc3VwcHJlc3Npb25JZCA9ICdDZGtOYWdTdXBwcmVzc2lvbic7XG4gIHJlYWRvbmx5IHZlcmJvc2U6IGJvb2xlYW47XG4gIHJlYWRvbmx5IGxvZ0lnbm9yZXM6IGJvb2xlYW47XG4gIGNvbnN0cnVjdG9yKHByb3BzPzogQW5ub3RhdGlvbkxvZ2dlclByb3BzKSB7XG4gICAgdGhpcy52ZXJib3NlID0gcHJvcHM/LnZlcmJvc2UgPz8gZmFsc2U7XG4gICAgdGhpcy5sb2dJZ25vcmVzID0gcHJvcHM/LmxvZ0lnbm9yZXMgPz8gZmFsc2U7XG4gIH1cbiAgb25Db21wbGlhbmNlKF9kYXRhOiBOYWdMb2dnZXJDb21wbGlhbmNlRGF0YSk6IHZvaWQge1xuICAgIHJldHVybjtcbiAgfVxuICBvbk5vbkNvbXBsaWFuY2UoZGF0YTogTmFnTG9nZ2VyTm9uQ29tcGxpYW5jZURhdGEpOiB2b2lkIHtcbiAgICBjb25zdCBtZXNzYWdlID0gdGhpcy5jcmVhdGVNZXNzYWdlKFxuICAgICAgZGF0YS5ydWxlSWQsXG4gICAgICBkYXRhLmZpbmRpbmdJZCxcbiAgICAgIGRhdGEucnVsZUluZm8sXG4gICAgICBkYXRhLnJ1bGVFeHBsYW5hdGlvbixcbiAgICAgIHRoaXMudmVyYm9zZVxuICAgICk7XG4gICAgc3dpdGNoIChkYXRhLnJ1bGVMZXZlbCkge1xuICAgICAgY2FzZSBOYWdNZXNzYWdlTGV2ZWwuRVJST1I6XG4gICAgICAgIEFubm90YXRpb25zLm9mKGRhdGEucmVzb3VyY2UpLmFkZEVycm9yKG1lc3NhZ2UpO1xuICAgICAgICBicmVhaztcbiAgICAgIGNhc2UgTmFnTWVzc2FnZUxldmVsLldBUk46XG4gICAgICAgIEFubm90YXRpb25zLm9mKGRhdGEucmVzb3VyY2UpLmFkZFdhcm5pbmcobWVzc2FnZSk7XG4gICAgICAgIGJyZWFrO1xuICAgICAgY2FzZSBOYWdNZXNzYWdlTGV2ZWwuSU5GTzpcbiAgICAgICAgQW5ub3RhdGlvbnMub2YoZGF0YS5yZXNvdXJjZSkuYWRkSW5mbyhtZXNzYWdlKTtcbiAgICAgICAgYnJlYWs7XG4gICAgICBkZWZhdWx0OlxuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgYFVucmVjb2duaXplZCBtZXNzYWdlIGxldmVsICR7ZGF0YS5ydWxlTGV2ZWx9IGZvciB0aGUgQW5ub3RhdGlvbkxvZ2dlcmBcbiAgICAgICAgKTtcbiAgICB9XG4gIH1cbiAgb25TdXBwcmVzc2VkKGRhdGE6IE5hZ0xvZ2dlclN1cHByZXNzZWREYXRhKTogdm9pZCB7XG4gICAgaWYgKHRoaXMubG9nSWdub3Jlcykge1xuICAgICAgY29uc3QgbWVzc2FnZSA9IHRoaXMuY3JlYXRlTWVzc2FnZShcbiAgICAgICAgdGhpcy5zdXBwcmVzc2lvbklkLFxuICAgICAgICBkYXRhLmZpbmRpbmdJZCxcbiAgICAgICAgYCR7ZGF0YS5ydWxlSWR9IHdhcyB0cmlnZ2VyZWQgYnV0IHN1cHByZXNzZWQuYCxcbiAgICAgICAgYFByb3ZpZGVkIHJlYXNvbjogXCIke2RhdGEuc3VwcHJlc3Npb25SZWFzb259XCJgLFxuICAgICAgICB0aGlzLnZlcmJvc2VcbiAgICAgICk7XG4gICAgICBBbm5vdGF0aW9ucy5vZihkYXRhLnJlc291cmNlKS5hZGRJbmZvKG1lc3NhZ2UpO1xuICAgIH1cbiAgfVxuICBvbkVycm9yKGRhdGE6IE5hZ0xvZ2dlckVycm9yRGF0YSk6IHZvaWQge1xuICAgIGNvbnN0IGluZm9ybWF0aW9uID0gYCcke2RhdGEucnVsZUlkfScgdGhyZXcgYW4gZXJyb3IgZHVyaW5nIHZhbGlkYXRpb24uIFRoaXMgaXMgZ2VuZXJhbGx5IGNhdXNlZCBieSBhIHBhcmFtZXRlciByZWZlcmVuY2luZyBhbiBpbnRyaW5zaWMgZnVuY3Rpb24uIFlvdSBjYW4gc3VwcHJlc3MgdGhlIFwiJHtWQUxJREFUSU9OX0ZBSUxVUkVfSUR9XCIgdG8gZ2V0IHJpZCBvZiB0aGlzIGVycm9yLiBGb3IgbW9yZSBkZXRhaWxzIGVuYWJsZSB2ZXJib3NlIGxvZ2dpbmcuJ2A7XG4gICAgY29uc3QgbWVzc2FnZSA9IHRoaXMuY3JlYXRlTWVzc2FnZShcbiAgICAgIFZBTElEQVRJT05fRkFJTFVSRV9JRCxcbiAgICAgIGRhdGEucnVsZUlkLFxuICAgICAgaW5mb3JtYXRpb24sXG4gICAgICBkYXRhLmVycm9yTWVzc2FnZSxcbiAgICAgIHRoaXMudmVyYm9zZVxuICAgICk7XG4gICAgQW5ub3RhdGlvbnMub2YoZGF0YS5yZXNvdXJjZSkuYWRkV2FybmluZyhtZXNzYWdlKTtcbiAgfVxuICBvblN1cHByZXNzZWRFcnJvcihkYXRhOiBOYWdMb2dnZXJTdXBwcmVzc2VkRXJyb3JEYXRhKTogdm9pZCB7XG4gICAgaWYgKHRoaXMubG9nSWdub3JlcyA9PT0gdHJ1ZSkge1xuICAgICAgY29uc3QgbWVzc2FnZSA9IHRoaXMuY3JlYXRlTWVzc2FnZShcbiAgICAgICAgdGhpcy5zdXBwcmVzc2lvbklkLFxuICAgICAgICBkYXRhLnJ1bGVJZCxcbiAgICAgICAgYCR7VkFMSURBVElPTl9GQUlMVVJFX0lEfSB3YXMgdHJpZ2dlcmVkIGJ1dCBzdXBwcmVzc2VkLmAsXG4gICAgICAgIGRhdGEuZXJyb3JTdXBwcmVzc2lvblJlYXNvbixcbiAgICAgICAgdGhpcy52ZXJib3NlXG4gICAgICApO1xuICAgICAgQW5ub3RhdGlvbnMub2YoZGF0YS5yZXNvdXJjZSkuYWRkSW5mbyhtZXNzYWdlKTtcbiAgICB9XG4gIH1cbiAgb25Ob3RBcHBsaWNhYmxlKF9kYXRhOiBOYWdMb2dnZXJOb3RBcHBsaWNhYmxlRGF0YSk6IHZvaWQge1xuICAgIHJldHVybjtcbiAgfVxuXG4gIHByb3RlY3RlZCBjcmVhdGVNZXNzYWdlKFxuICAgIHJ1bGVJZDogc3RyaW5nLFxuICAgIGZpbmRpbmdJZDogc3RyaW5nLFxuICAgIHJ1bGVJbmZvOiBzdHJpbmcsXG4gICAgcnVsZUV4cGxhbmF0aW9uOiBzdHJpbmcsXG4gICAgdmVyYm9zZTogYm9vbGVhblxuICApOiBzdHJpbmcge1xuICAgIGxldCBtZXNzYWdlID0gZmluZGluZ0lkXG4gICAgICA/IGAke3J1bGVJZH1bJHtmaW5kaW5nSWR9XTogJHtydWxlSW5mb31gXG4gICAgICA6IGAke3J1bGVJZH06ICR7cnVsZUluZm99YDtcbiAgICByZXR1cm4gdmVyYm9zZSA/IGAke21lc3NhZ2V9ICR7cnVsZUV4cGxhbmF0aW9ufVxcbmAgOiBgJHttZXNzYWdlfVxcbmA7XG4gIH1cbn1cblxuZXhwb3J0IGludGVyZmFjZSBOYWdSZXBvcnRTY2hlbWEge1xuICByZWFkb25seSBsaW5lczogTmFnUmVwb3J0TGluZVtdO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIE5hZ1JlcG9ydExpbmUge1xuICByZWFkb25seSBydWxlSWQ6IHN0cmluZztcbiAgcmVhZG9ubHkgcmVzb3VyY2VJZDogc3RyaW5nO1xuICByZWFkb25seSBjb21wbGlhbmNlOiBzdHJpbmc7XG4gIHJlYWRvbmx5IGV4Y2VwdGlvblJlYXNvbjogc3RyaW5nO1xuICByZWFkb25seSBydWxlTGV2ZWw6IHN0cmluZztcbiAgcmVhZG9ubHkgcnVsZUluZm86IHN0cmluZztcbn1cblxuLyoqXG4gKiBQb3NzaWJsZSBvdXRwdXQgZm9ybWF0cyBvZiB0aGUgTmFnUmVwb3J0XG4gKi9cbmV4cG9ydCBlbnVtIE5hZ1JlcG9ydEZvcm1hdCB7XG4gIENTViA9ICdjc3YnLFxuICBKU09OID0gJ2pzb24nLFxufVxuXG4vKipcbiAqIFByb3BzIGZvciB0aGUgTmFnUmVwb3J0TG9nZ2VyXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgTmFnUmVwb3J0TG9nZ2VyUHJvcHMge1xuICByZWFkb25seSBmb3JtYXRzOiBOYWdSZXBvcnRGb3JtYXRbXTtcbn1cblxuLyoqXG4gKiBBIE5hZ0xvZ2dlciB0aGF0IGNyZWF0ZXMgY29tcGxpYW5jZSByZXBvcnRzXG4gKi9cbmV4cG9ydCBjbGFzcyBOYWdSZXBvcnRMb2dnZXIgaW1wbGVtZW50cyBJTmFnTG9nZ2VyIHtcbiAgcHJpdmF0ZSByZXBvcnRTdGFja3MgPSBuZXcgTWFwPE5hZ1JlcG9ydEZvcm1hdCwgQXJyYXk8c3RyaW5nPj4oKTtcbiAgcmVhZG9ubHkgZm9ybWF0czogTmFnUmVwb3J0Rm9ybWF0W107XG4gIGNvbnN0cnVjdG9yKHByb3BzOiBOYWdSZXBvcnRMb2dnZXJQcm9wcykge1xuICAgIGlmIChwcm9wcy5mb3JtYXRzLmxlbmd0aCA9PT0gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdNdXN0IHByb3ZpZGUgYXQgbGVhc3QgMSBOYWdSZXBvcnRGb3JtYXQuJyk7XG4gICAgfVxuICAgIHRoaXMuZm9ybWF0cyA9IHByb3BzLmZvcm1hdHM7XG4gIH1cblxuICBvbkNvbXBsaWFuY2UoZGF0YTogTmFnTG9nZ2VyQ29tcGxpYW5jZURhdGEpOiB2b2lkIHtcbiAgICB0aGlzLmluaXRpYWxpemVTdGFja1JlcG9ydChkYXRhKTtcbiAgICB0aGlzLndyaXRlVG9TdGFja0NvbXBsaWFuY2VSZXBvcnQoZGF0YSwgTmFnUnVsZUNvbXBsaWFuY2UuQ09NUExJQU5UKTtcbiAgfVxuICBvbk5vbkNvbXBsaWFuY2UoZGF0YTogTmFnTG9nZ2VyTm9uQ29tcGxpYW5jZURhdGEpOiB2b2lkIHtcbiAgICB0aGlzLmluaXRpYWxpemVTdGFja1JlcG9ydChkYXRhKTtcbiAgICB0aGlzLndyaXRlVG9TdGFja0NvbXBsaWFuY2VSZXBvcnQoZGF0YSwgTmFnUnVsZUNvbXBsaWFuY2UuTk9OX0NPTVBMSUFOVCk7XG4gIH1cbiAgb25TdXBwcmVzc2VkKGRhdGE6IE5hZ0xvZ2dlclN1cHByZXNzZWREYXRhKTogdm9pZCB7XG4gICAgdGhpcy5pbml0aWFsaXplU3RhY2tSZXBvcnQoZGF0YSk7XG4gICAgdGhpcy53cml0ZVRvU3RhY2tDb21wbGlhbmNlUmVwb3J0KFxuICAgICAgZGF0YSxcbiAgICAgIE5hZ1J1bGVQb3N0VmFsaWRhdGlvblN0YXRlcy5TVVBQUkVTU0VEXG4gICAgKTtcbiAgfVxuICBvbkVycm9yKGRhdGE6IE5hZ0xvZ2dlckVycm9yRGF0YSk6IHZvaWQge1xuICAgIHRoaXMuaW5pdGlhbGl6ZVN0YWNrUmVwb3J0KGRhdGEpO1xuICAgIHRoaXMud3JpdGVUb1N0YWNrQ29tcGxpYW5jZVJlcG9ydChcbiAgICAgIGRhdGEsXG4gICAgICBOYWdSdWxlUG9zdFZhbGlkYXRpb25TdGF0ZXMuVU5LTk9XTlxuICAgICk7XG4gIH1cbiAgb25TdXBwcmVzc2VkRXJyb3IoZGF0YTogTmFnTG9nZ2VyU3VwcHJlc3NlZEVycm9yRGF0YSk6IHZvaWQge1xuICAgIHRoaXMuaW5pdGlhbGl6ZVN0YWNrUmVwb3J0KGRhdGEpO1xuICAgIHRoaXMud3JpdGVUb1N0YWNrQ29tcGxpYW5jZVJlcG9ydChcbiAgICAgIGRhdGEsXG4gICAgICBOYWdSdWxlUG9zdFZhbGlkYXRpb25TdGF0ZXMuU1VQUFJFU1NFRFxuICAgICk7XG4gIH1cbiAgb25Ob3RBcHBsaWNhYmxlKGRhdGE6IE5hZ0xvZ2dlck5vdEFwcGxpY2FibGVEYXRhKTogdm9pZCB7XG4gICAgdGhpcy5pbml0aWFsaXplU3RhY2tSZXBvcnQoZGF0YSk7XG4gIH1cblxuICBwdWJsaWMgZ2V0Rm9ybWF0U3RhY2tzKGZvcm1hdDogTmFnUmVwb3J0Rm9ybWF0KTogc3RyaW5nW10ge1xuICAgIHJldHVybiB0aGlzLnJlcG9ydFN0YWNrcy5nZXQoZm9ybWF0KSA/PyBbXTtcbiAgfVxuXG4gIC8qKlxuICAgKiBJbml0aWFsaXplIHRoZSByZXBvcnQgZm9yIHRoZSBydWxlIHBhY2sncyBjb21wbGlhbmNlIHJlcG9ydCBmb3IgdGhlIHJlc291cmNlJ3MgU3RhY2sgaWYgaXQgZG9lc24ndCBleGlzdFxuICAgKiBAcGFyYW0gZGF0YVxuICAgKi9cbiAgcHJvdGVjdGVkIGluaXRpYWxpemVTdGFja1JlcG9ydChkYXRhOiBOYWdMb2dnZXJCYXNlRGF0YSk6IHZvaWQge1xuICAgIGZvciAoY29uc3QgZm9ybWF0IG9mIHRoaXMuZm9ybWF0cykge1xuICAgICAgY29uc3QgYXNzZW1ibHkgPSBTdGFnZS5vZihkYXRhLnJlc291cmNlLnN0YWNrKTtcbiAgICAgIGNvbnN0IHByZWZpeCA9IGFzc2VtYmx5ID8gYCR7YXNzZW1ibHkubm9kZS5pZH0tYCA6ICcnO1xuICAgICAgY29uc3Qgc3RhY2tOYW1lID0gZGF0YS5yZXNvdXJjZS5zdGFjay5uZXN0ZWRcbiAgICAgICAgPyBOYW1lcy51bmlxdWVJZChkYXRhLnJlc291cmNlLnN0YWNrKVxuICAgICAgICA6IGRhdGEucmVzb3VyY2Uuc3RhY2suc3RhY2tOYW1lO1xuICAgICAgY29uc3QgZmlsZU5hbWUgPSBgJHtkYXRhLm5hZ1BhY2tOYW1lfS0ke3ByZWZpeH0ke3N0YWNrTmFtZX0tTmFnUmVwb3J0LiR7Zm9ybWF0fWA7XG4gICAgICBjb25zdCBzdGFja3MgPSB0aGlzLmdldEZvcm1hdFN0YWNrcyhmb3JtYXQpO1xuICAgICAgaWYgKCFzdGFja3MuaW5jbHVkZXMoZmlsZU5hbWUpKSB7XG4gICAgICAgIGNvbnN0IGZpbGVQYXRoID0gam9pbihBcHAub2YoZGF0YS5yZXNvdXJjZSk/Lm91dGRpciA/PyAnJywgZmlsZU5hbWUpO1xuICAgICAgICB0aGlzLnJlcG9ydFN0YWNrcy5zZXQoZm9ybWF0LCBbLi4uc3RhY2tzLCBmaWxlTmFtZV0pO1xuICAgICAgICBsZXQgYm9keSA9ICcnO1xuICAgICAgICBpZiAoZm9ybWF0ID09PSBOYWdSZXBvcnRGb3JtYXQuQ1NWKSB7XG4gICAgICAgICAgYm9keSA9XG4gICAgICAgICAgICAnUnVsZSBJRCxSZXNvdXJjZSBJRCxDb21wbGlhbmNlLEV4Y2VwdGlvbiBSZWFzb24sUnVsZSBMZXZlbCxSdWxlIEluZm9cXG4nO1xuICAgICAgICB9IGVsc2UgaWYgKGZvcm1hdCA9PT0gTmFnUmVwb3J0Rm9ybWF0LkpTT04pIHtcbiAgICAgICAgICBib2R5ID0gSlNPTi5zdHJpbmdpZnkoeyBsaW5lczogW10gfSBhcyBOYWdSZXBvcnRTY2hlbWEpO1xuICAgICAgICB9IGVsc2Uge1xuICAgICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgIGBVbnJlY29nbml6ZWQgb3V0cHV0IGZvcm1hdCAke2Zvcm1hdH0gZm9yIHRoZSBOYWdSZXBvcnRMb2dnZXJgXG4gICAgICAgICAgKTtcbiAgICAgICAgfVxuICAgICAgICB3cml0ZUZpbGVTeW5jKGZpbGVQYXRoLCBib2R5KTtcbiAgICAgIH1cbiAgICB9XG4gIH1cblxuICBwcm90ZWN0ZWQgd3JpdGVUb1N0YWNrQ29tcGxpYW5jZVJlcG9ydChcbiAgICBkYXRhOiBOYWdMb2dnZXJCYXNlRGF0YSxcbiAgICBjb21wbGlhbmNlOiBOYWdSdWxlU3RhdGVzXG4gICk6IHZvaWQge1xuICAgIGZvciAoY29uc3QgZm9ybWF0IG9mIHRoaXMuZm9ybWF0cykge1xuICAgICAgY29uc3QgYXNzZW1ibHkgPSBTdGFnZS5vZihkYXRhLnJlc291cmNlLnN0YWNrKTtcbiAgICAgIGNvbnN0IHByZWZpeCA9IGFzc2VtYmx5ID8gYCR7YXNzZW1ibHkubm9kZS5pZH0tYCA6ICcnO1xuICAgICAgY29uc3Qgc3RhY2tOYW1lID0gZGF0YS5yZXNvdXJjZS5zdGFjay5uZXN0ZWRcbiAgICAgICAgPyBOYW1lcy51bmlxdWVJZChkYXRhLnJlc291cmNlLnN0YWNrKVxuICAgICAgICA6IGRhdGEucmVzb3VyY2Uuc3RhY2suc3RhY2tOYW1lO1xuICAgICAgY29uc3QgZmlsZU5hbWUgPSBgJHtkYXRhLm5hZ1BhY2tOYW1lfS0ke3ByZWZpeH0ke3N0YWNrTmFtZX0tTmFnUmVwb3J0LiR7Zm9ybWF0fWA7XG4gICAgICBjb25zdCBmaWxlUGF0aCA9IGpvaW4oQXBwLm9mKGRhdGEucmVzb3VyY2UpPy5vdXRkaXIgPz8gJycsIGZpbGVOYW1lKTtcbiAgICAgIGlmIChmb3JtYXQgPT09IE5hZ1JlcG9ydEZvcm1hdC5DU1YpIHtcbiAgICAgICAgLy98IFJ1bGUgSUQgfCBSZXNvdXJjZSBJRCB8IENvbXBsaWFuY2UgfCBFeGNlcHRpb24gUmVhc29uIHwgUnVsZSBMZXZlbCB8IFJ1bGUgSW5mb1xuICAgICAgICBjb25zdCBsaW5lID0gQXJyYXk8c3RyaW5nPigpO1xuICAgICAgICBsaW5lLnB1c2goZGF0YS5ydWxlSWQpO1xuICAgICAgICBsaW5lLnB1c2goZGF0YS5yZXNvdXJjZS5ub2RlLnBhdGgpO1xuICAgICAgICBpZiAoY29tcGxpYW5jZSA9PT0gTmFnUnVsZVBvc3RWYWxpZGF0aW9uU3RhdGVzLlNVUFBSRVNTRUQpIHtcbiAgICAgICAgICBsaW5lLnB1c2goTmFnUnVsZVBvc3RWYWxpZGF0aW9uU3RhdGVzLlNVUFBSRVNTRUQpO1xuICAgICAgICAgIGlmIChcbiAgICAgICAgICAgIChkYXRhIGFzIE5hZ0xvZ2dlclN1cHByZXNzZWREYXRhKS5zdXBwcmVzc2lvblJlYXNvbiAhPT0gdW5kZWZpbmVkXG4gICAgICAgICAgKSB7XG4gICAgICAgICAgICBsaW5lLnB1c2goKGRhdGEgYXMgTmFnTG9nZ2VyU3VwcHJlc3NlZERhdGEpLnN1cHByZXNzaW9uUmVhc29uKTtcbiAgICAgICAgICB9IGVsc2Uge1xuICAgICAgICAgICAgbGluZS5wdXNoKFxuICAgICAgICAgICAgICAoZGF0YSBhcyBOYWdMb2dnZXJTdXBwcmVzc2VkRXJyb3JEYXRhKS5lcnJvclN1cHByZXNzaW9uUmVhc29uXG4gICAgICAgICAgICApO1xuICAgICAgICAgIH1cbiAgICAgICAgfSBlbHNlIHtcbiAgICAgICAgICBsaW5lLnB1c2goY29tcGxpYW5jZSk7XG4gICAgICAgICAgbGluZS5wdXNoKCdOL0EnKTtcbiAgICAgICAgfVxuICAgICAgICBsaW5lLnB1c2goZGF0YS5ydWxlTGV2ZWwpO1xuICAgICAgICBsaW5lLnB1c2goZGF0YS5ydWxlSW5mbyk7XG4gICAgICAgIGFwcGVuZEZpbGVTeW5jKFxuICAgICAgICAgIGZpbGVQYXRoLFxuICAgICAgICAgIGxpbmUubWFwKChpKSA9PiAnXCInICsgaS5yZXBsYWNlKC9cIi9nLCAnXCJcIicpICsgJ1wiJykuam9pbignLCcpICsgJ1xcbidcbiAgICAgICAgKTtcbiAgICAgIH0gZWxzZSBpZiAoZm9ybWF0ID09PSBOYWdSZXBvcnRGb3JtYXQuSlNPTikge1xuICAgICAgICBjb25zdCByZXBvcnQgPSBKU09OLnBhcnNlKFxuICAgICAgICAgIHJlYWRGaWxlU3luYyhmaWxlUGF0aCwgJ3V0ZjgnKVxuICAgICAgICApIGFzIE5hZ1JlcG9ydFNjaGVtYTtcbiAgICAgICAgbGV0IGV4Y2VwdGlvblJlYXNvbiA9ICdOL0EnO1xuICAgICAgICBpZiAoY29tcGxpYW5jZSA9PT0gTmFnUnVsZVBvc3RWYWxpZGF0aW9uU3RhdGVzLlNVUFBSRVNTRUQpIHtcbiAgICAgICAgICBpZiAoXG4gICAgICAgICAgICAoZGF0YSBhcyBOYWdMb2dnZXJTdXBwcmVzc2VkRGF0YSkuc3VwcHJlc3Npb25SZWFzb24gIT09IHVuZGVmaW5lZFxuICAgICAgICAgICkge1xuICAgICAgICAgICAgZXhjZXB0aW9uUmVhc29uID0gKGRhdGEgYXMgTmFnTG9nZ2VyU3VwcHJlc3NlZERhdGEpXG4gICAgICAgICAgICAgIC5zdXBwcmVzc2lvblJlYXNvbjtcbiAgICAgICAgICB9IGVsc2Uge1xuICAgICAgICAgICAgZXhjZXB0aW9uUmVhc29uID0gKGRhdGEgYXMgTmFnTG9nZ2VyU3VwcHJlc3NlZEVycm9yRGF0YSlcbiAgICAgICAgICAgICAgLmVycm9yU3VwcHJlc3Npb25SZWFzb247XG4gICAgICAgICAgfVxuICAgICAgICB9XG4gICAgICAgIHJlcG9ydC5saW5lcy5wdXNoKHtcbiAgICAgICAgICBydWxlSWQ6IGRhdGEucnVsZUlkLFxuICAgICAgICAgIHJlc291cmNlSWQ6IGRhdGEucmVzb3VyY2Uubm9kZS5wYXRoLFxuICAgICAgICAgIGNvbXBsaWFuY2UsXG4gICAgICAgICAgZXhjZXB0aW9uUmVhc29uLFxuICAgICAgICAgIHJ1bGVMZXZlbDogZGF0YS5ydWxlTGV2ZWwsXG4gICAgICAgICAgcnVsZUluZm86IGRhdGEucnVsZUluZm8sXG4gICAgICAgIH0pO1xuICAgICAgICB3cml0ZUZpbGVTeW5jKGZpbGVQYXRoLCBKU09OLnN0cmluZ2lmeShyZXBvcnQpKTtcbiAgICAgIH0gZWxzZSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICBgVW5yZWNvZ25pemVkIG91dHB1dCBmb3JtYXQgJHtmb3JtYXR9IGZvciB0aGUgTmFnUmVwb3J0TG9nZ2VyYFxuICAgICAgICApO1xuICAgICAgfVxuICAgIH1cbiAgfVxufVxuIl19
|
|
16
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFnLWxvZ2dlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9uYWctbG9nZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQTs7O0VBR0U7OztBQW9CRjs7R0FFRztBQUNILElBQVksZUFHWDtBQUhELFdBQVksZUFBZTtJQUN6Qiw4QkFBVyxDQUFBO0lBQ1gsZ0NBQWEsQ0FBQTtBQUNmLENBQUMsRUFIVyxlQUFlLCtCQUFmLGVBQWUsUUFHMUIiLCJzb3VyY2VzQ29udGVudCI6WyIvKlxuQ29weXJpZ2h0IEFtYXpvbi5jb20sIEluYy4gb3IgaXRzIGFmZmlsaWF0ZXMuIEFsbCBSaWdodHMgUmVzZXJ2ZWQuXG5TUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuKi9cblxuLyoqXG4gKiBTY2hlbWEgZm9yIHRoZSBOYWdSZXBvcnQgb3V0cHV0LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIE5hZ1JlcG9ydFNjaGVtYSB7XG4gIHJlYWRvbmx5IGxpbmVzOiBOYWdSZXBvcnRMaW5lW107XG59XG5cbi8qKlxuICogQSBzaW5nbGUgbGluZSBpbiBhIE5hZ1JlcG9ydC5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBOYWdSZXBvcnRMaW5lIHtcbiAgcmVhZG9ubHkgcnVsZUlkOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHJlc291cmNlSWQ6IHN0cmluZztcbiAgcmVhZG9ubHkgY29tcGxpYW5jZTogc3RyaW5nO1xuICByZWFkb25seSBydWxlTGV2ZWw6IHN0cmluZztcbiAgcmVhZG9ubHkgcnVsZUluZm86IHN0cmluZztcbn1cblxuLyoqXG4gKiBQb3NzaWJsZSBvdXRwdXQgZm9ybWF0cyBvZiB0aGUgTmFnUmVwb3J0LlxuICovXG5leHBvcnQgZW51bSBOYWdSZXBvcnRGb3JtYXQge1xuICBDU1YgPSAnY3N2JyxcbiAgSlNPTiA9ICdqc29uJyxcbn1cbiJdfQ==
|
|
@@ -1,9 +1,13 @@
|
|
|
1
|
-
import { CfnResource, IAspect } from 'aws-cdk-lib';
|
|
1
|
+
import { CfnResource, IAspect, IPolicyValidationPlugin, IPolicyValidationContext, PolicyValidationPluginReport } from 'aws-cdk-lib';
|
|
2
2
|
import { IConstruct } from 'constructs';
|
|
3
|
-
import { INagSuppressionIgnore } from './ignore-suppression-conditions';
|
|
4
|
-
import { NagPackSuppression } from './models/nag-suppression';
|
|
5
|
-
import { INagLogger, NagReportFormat } from './nag-logger';
|
|
6
3
|
import { NagMessageLevel, NagRuleResult } from './nag-rules';
|
|
4
|
+
/**
|
|
5
|
+
* Extended validation context that includes the construct tree.
|
|
6
|
+
* Requires CDK core change to populate `appConstruct` during plugin validation.
|
|
7
|
+
*/
|
|
8
|
+
export interface INagValidationContext extends IPolicyValidationContext {
|
|
9
|
+
readonly appConstruct: IConstruct;
|
|
10
|
+
}
|
|
7
11
|
/**
|
|
8
12
|
* Interface for creating a NagPack.
|
|
9
13
|
*/
|
|
@@ -13,25 +17,11 @@ export interface NagPackProps {
|
|
|
13
17
|
*/
|
|
14
18
|
readonly verbose?: boolean;
|
|
15
19
|
/**
|
|
16
|
-
* Whether
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
/**
|
|
20
|
-
* Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true).
|
|
21
|
-
*/
|
|
22
|
-
readonly reports?: boolean;
|
|
23
|
-
/**
|
|
24
|
-
* If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV).
|
|
25
|
-
*/
|
|
26
|
-
readonly reportFormats?: NagReportFormat[];
|
|
27
|
-
/**
|
|
28
|
-
* Conditionally prevent rules from being suppressed (default: no user provided condition).
|
|
20
|
+
* Whether to write acknowledged rules into CfnResource CloudFormation
|
|
21
|
+
* Metadata as `cdk_nag: { rules_to_suppress: [...] }` for backwards
|
|
22
|
+
* compatibility with v2 audit trail tooling (default: false).
|
|
29
23
|
*/
|
|
30
|
-
readonly
|
|
31
|
-
/**
|
|
32
|
-
* Additional NagLoggers for logging rule validation outputs.
|
|
33
|
-
*/
|
|
34
|
-
readonly additionalLoggers?: INagLogger[];
|
|
24
|
+
readonly writeSuppressionsToCloudFormation?: boolean;
|
|
35
25
|
}
|
|
36
26
|
/**
|
|
37
27
|
* Interface for JSII interoperability for passing parameters and the Rule Callback to @applyRule method.
|
|
@@ -53,10 +43,6 @@ export interface IApplyRule {
|
|
|
53
43
|
* The annotations message level to apply to the rule if triggered.
|
|
54
44
|
*/
|
|
55
45
|
level: NagMessageLevel;
|
|
56
|
-
/**
|
|
57
|
-
* A condition in which a suppression should be ignored.
|
|
58
|
-
*/
|
|
59
|
-
ignoreSuppressionCondition?: INagSuppressionIgnore;
|
|
60
46
|
/**
|
|
61
47
|
* The CfnResource to check
|
|
62
48
|
*/
|
|
@@ -68,34 +54,61 @@ export interface IApplyRule {
|
|
|
68
54
|
rule(node: CfnResource): NagRuleResult;
|
|
69
55
|
}
|
|
70
56
|
/**
|
|
71
|
-
* Base class for all rule packs.
|
|
57
|
+
* Base class for all rule packs. Implements IPolicyValidationPlugin so that
|
|
58
|
+
* packs are registered via `Validations.of(app).addPlugins(new MyPack(app))`
|
|
59
|
+
* instead of `Aspects.of(app).add(...)`.
|
|
72
60
|
*/
|
|
73
|
-
export declare abstract class NagPack implements
|
|
74
|
-
|
|
61
|
+
export declare abstract class NagPack implements IPolicyValidationPlugin {
|
|
62
|
+
abstract readonly name: string;
|
|
63
|
+
readonly version?: string;
|
|
64
|
+
readonly ruleIds?: string[];
|
|
75
65
|
protected packName: string;
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
constructor(props?: NagPackProps);
|
|
66
|
+
private violations;
|
|
67
|
+
private verbose;
|
|
68
|
+
constructor(scope?: IConstruct, props?: NagPackProps);
|
|
79
69
|
get readPackName(): string;
|
|
80
70
|
/**
|
|
81
|
-
*
|
|
71
|
+
* Entry point called by the CDK validation framework.
|
|
72
|
+
* Requires `appConstruct` to be present on the context (CDK core change).
|
|
73
|
+
* For testing or direct invocation, use `validateScope(scope)`.
|
|
74
|
+
*/
|
|
75
|
+
validate(context: IPolicyValidationContext): PolicyValidationPluginReport;
|
|
76
|
+
/**
|
|
77
|
+
* Validate a construct tree directly. This is the primary entry point
|
|
78
|
+
* for testing and for CDK versions that do not yet provide `appConstruct` on
|
|
79
|
+
* `IPolicyValidationContext`.
|
|
80
|
+
*/
|
|
81
|
+
validateScope(scope: IConstruct): PolicyValidationPluginReport;
|
|
82
|
+
/**
|
|
83
|
+
* Recursively walk the construct tree and invoke checkResource on each CfnResource.
|
|
84
|
+
*/
|
|
85
|
+
private walkTree;
|
|
86
|
+
/**
|
|
87
|
+
* Subclasses implement this to apply rules to each CfnResource.
|
|
82
88
|
*/
|
|
83
|
-
abstract
|
|
89
|
+
protected abstract checkResource(node: CfnResource): void;
|
|
84
90
|
/**
|
|
85
91
|
* Create a rule to be used in the NagPack.
|
|
86
92
|
* @param params The @IApplyRule interface with rule details.
|
|
87
93
|
*/
|
|
88
94
|
protected applyRule(params: IApplyRule): void;
|
|
89
95
|
/**
|
|
90
|
-
*
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
*
|
|
95
|
-
*
|
|
96
|
-
*
|
|
96
|
+
* Add a violation to the internal violations array, grouping by ruleName.
|
|
97
|
+
*/
|
|
98
|
+
private addViolation;
|
|
99
|
+
/**
|
|
100
|
+
* Check whether a specific rule has been acknowledged on the given resource
|
|
101
|
+
* or any of its ancestor constructs via the CDK Validations
|
|
102
|
+
* acknowledged-rules metadata mechanism.
|
|
97
103
|
*/
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
104
|
+
private isAcknowledged;
|
|
105
|
+
}
|
|
106
|
+
/**
|
|
107
|
+
* An IAspect that reads acknowledged rules from construct metadata and writes
|
|
108
|
+
* them into the CfnResource's CloudFormation Metadata for audit trail
|
|
109
|
+
* persistence in the synthesized template. Preserves the v2 `cdk_nag`
|
|
110
|
+
* metadata format.
|
|
111
|
+
*/
|
|
112
|
+
export declare class WriteNagSuppressionsToCloudFormationAspect implements IAspect {
|
|
113
|
+
visit(node: IConstruct): void;
|
|
101
114
|
}
|