cdk-insights 0.18.1 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +92 -0
- package/README.md +110 -94
- package/dist/cli/types/cli.types.d.ts +2 -0
- package/dist/entry.js +167 -167
- package/dist/index.js +2 -2
- package/package.json +2 -2
package/LICENSE
ADDED
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
Business Source License 1.1
|
|
2
|
+
|
|
3
|
+
Parameters
|
|
4
|
+
|
|
5
|
+
Licensor: Instance Labs Ltd
|
|
6
|
+
Licensed Work: CDK Insights 1.0.0
|
|
7
|
+
The Licensed Work is (c) 2025-2026 Instance Labs Ltd.
|
|
8
|
+
Additional Use Grant: You may make production use of the Licensed Work,
|
|
9
|
+
provided your use does not include offering the
|
|
10
|
+
Licensed Work to third parties as a commercial
|
|
11
|
+
CDK/CloudFormation analysis service, or using the
|
|
12
|
+
Licensed Work to create a product or service that
|
|
13
|
+
competes with the Licensed Work.
|
|
14
|
+
Change Date: 2030-04-12
|
|
15
|
+
Change License: Apache License, Version 2.0
|
|
16
|
+
|
|
17
|
+
For information about alternative licensing arrangements for the Licensed
|
|
18
|
+
Work, please contact: support@cdkinsights.dev
|
|
19
|
+
|
|
20
|
+
Notice
|
|
21
|
+
|
|
22
|
+
Business Source License 1.1
|
|
23
|
+
|
|
24
|
+
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
|
25
|
+
"Business Source License" is a trademark of MariaDB Corporation Ab.
|
|
26
|
+
|
|
27
|
+
Terms
|
|
28
|
+
|
|
29
|
+
The Licensor hereby grants you the right to copy, modify, create derivative
|
|
30
|
+
works, redistribute, and make non-production use of the Licensed Work. The
|
|
31
|
+
Licensor may make an Additional Use Grant, above, permitting limited
|
|
32
|
+
production use.
|
|
33
|
+
|
|
34
|
+
Effective on the Change Date, or the fourth anniversary of the first publicly
|
|
35
|
+
available distribution of a specific version of the Licensed Work under this
|
|
36
|
+
License, whichever comes first, the Licensor hereby grants you rights under
|
|
37
|
+
the terms of the Change License, and the rights granted in the paragraph
|
|
38
|
+
above terminate.
|
|
39
|
+
|
|
40
|
+
If your use of the Licensed Work does not comply with the requirements
|
|
41
|
+
currently in effect as described in this License, you must purchase a
|
|
42
|
+
commercial license from the Licensor, its affiliated entities, or authorized
|
|
43
|
+
resellers, or you must refrain from using the Licensed Work.
|
|
44
|
+
|
|
45
|
+
All copies of the original and modified Licensed Work, and derivative works
|
|
46
|
+
of the Licensed Work, are subject to this License. This License applies
|
|
47
|
+
separately for each version of the Licensed Work and the Change Date may
|
|
48
|
+
vary for each version of the Licensed Work released by Licensor.
|
|
49
|
+
|
|
50
|
+
You must conspicuously display this License on each original or modified copy
|
|
51
|
+
of the Licensed Work. If you receive the Licensed Work in original or
|
|
52
|
+
modified form from a third party, the terms and conditions set forth in this
|
|
53
|
+
License apply to your use of that work.
|
|
54
|
+
|
|
55
|
+
Any use of the Licensed Work in violation of this License will automatically
|
|
56
|
+
terminate your rights under this License for the current and all other
|
|
57
|
+
versions of the Licensed Work.
|
|
58
|
+
|
|
59
|
+
This License does not grant you any right in any trademark or logo of
|
|
60
|
+
Licensor or its affiliates (provided that you may use a trademark or logo of
|
|
61
|
+
Licensor as expressly required by this License).
|
|
62
|
+
|
|
63
|
+
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
|
64
|
+
AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
|
65
|
+
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
|
66
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
|
67
|
+
TITLE.
|
|
68
|
+
|
|
69
|
+
MariaDB hereby grants you permission to use this License's text to license
|
|
70
|
+
your works, and to refer to it using the trademark "Business Source License",
|
|
71
|
+
as long as you comply with the Covenants of Licensor below.
|
|
72
|
+
|
|
73
|
+
Covenants of Licensor
|
|
74
|
+
|
|
75
|
+
In consideration of the right to use this License's text and the "Business
|
|
76
|
+
Source License" name and trademark, Licensor covenants to MariaDB, and to all
|
|
77
|
+
other recipients of the licensed work to be provided under this License:
|
|
78
|
+
|
|
79
|
+
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
|
80
|
+
or a license that is compatible with GPL Version 2.0 or a later version,
|
|
81
|
+
where "compatible" means that software provided under the Change License can
|
|
82
|
+
be included in a program with software provided under GPL Version 2.0 or a
|
|
83
|
+
later version. Licensor may specify additional Change Licenses without
|
|
84
|
+
limitation.
|
|
85
|
+
|
|
86
|
+
2. To either: (a) specify an additional grant of rights to use that does not
|
|
87
|
+
impose any additional restriction on the right granted in this License, as
|
|
88
|
+
the Additional Use Grant; or (b) insert the text "None".
|
|
89
|
+
|
|
90
|
+
3. To specify a Change Date.
|
|
91
|
+
|
|
92
|
+
4. Not to modify this License in any other way.
|
package/README.md
CHANGED
|
@@ -1,35 +1,55 @@
|
|
|
1
1
|
# CDK Insights 🔍
|
|
2
2
|
|
|
3
|
-
**
|
|
4
|
-
Scan your AWS CDK stacks for **security vulnerabilities, cost optimization opportunities, and best practice issues**.
|
|
5
|
-
Integrating and building upon tool like **cdk-nag**, CDK Insights adds **AI-powered recommendations** for smarter cloud infrastructure improvements.
|
|
3
|
+
**Catch security issues in your AWS CDK before they reach production.**
|
|
6
4
|
|
|
7
|
-
|
|
5
|
+
Scan your CDK stacks for security vulnerabilities, cost waste, compliance violations, and best practice issues — across 100+ rules and 35+ AWS services. Your source code never leaves your machine.
|
|
6
|
+
|
|
7
|
+
[](https://www.npmjs.com/package/cdk-insights)
|
|
8
|
+
[](https://www.npmjs.com/package/cdk-insights)
|
|
9
|
+
|
|
10
|
+
👉 **[cdkinsights.dev](https://cdkinsights.dev)** | **[Full Documentation](https://cdkinsights.dev/docs)**
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## Why CDK Insights?
|
|
15
|
+
|
|
16
|
+
Existing tools (Checkov, cfn-lint, cfn_nag) scan raw CloudFormation. They don't understand CDK constructs, L2/L3 patterns, or developer intent.
|
|
17
|
+
|
|
18
|
+
CDK Insights is **purpose-built for CDK** — it synthesizes your stacks and analyzes them with CDK context, integrating CDK Nag alongside 100+ custom rules.
|
|
19
|
+
|
|
20
|
+
**Key differences:**
|
|
21
|
+
- **Local-first** — static analysis runs entirely on your machine, no code uploaded
|
|
22
|
+
- **Zero friction** — no signup, no account, no API keys
|
|
23
|
+
- **Free forever** — static analysis with 100+ rules, JSON/Table/Markdown output, no limits
|
|
24
|
+
- **CDK-native** — understands constructs and patterns, not just CloudFormation
|
|
25
|
+
- **CI/CD ready** — GitHub Action with PR comments and merge blocking
|
|
8
26
|
|
|
9
27
|
---
|
|
10
28
|
|
|
11
29
|
## 🚀 Quick Start
|
|
12
30
|
|
|
13
31
|
```bash
|
|
14
|
-
#
|
|
32
|
+
# Run instantly — no install needed
|
|
15
33
|
npx cdk-insights scan
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
That's it. CDK Insights will synthesize your stacks and scan them.
|
|
37
|
+
|
|
38
|
+
### Install in your project
|
|
16
39
|
|
|
17
|
-
|
|
40
|
+
```bash
|
|
41
|
+
# Add to your project
|
|
18
42
|
npm install --save-dev cdk-insights
|
|
19
43
|
|
|
20
|
-
#
|
|
44
|
+
# Set up npm scripts automatically
|
|
21
45
|
npx cdk-insights init
|
|
22
46
|
|
|
23
|
-
# Then use familiar
|
|
47
|
+
# Then use familiar commands
|
|
24
48
|
npm run cdk-insights
|
|
25
|
-
npm run cdk-insights:all
|
|
26
|
-
npm run cdk-insights:ci
|
|
27
49
|
```
|
|
28
50
|
|
|
29
51
|
### What `cdk-insights init` adds
|
|
30
52
|
|
|
31
|
-
The `init` command adds these npm scripts to your `package.json`:
|
|
32
|
-
|
|
33
53
|
```json
|
|
34
54
|
{
|
|
35
55
|
"scripts": {
|
|
@@ -44,47 +64,68 @@ The `init` command adds these npm scripts to your `package.json`:
|
|
|
44
64
|
|
|
45
65
|
Use `npx cdk-insights init --all` to include additional scripts for GitHub issues and summary output.
|
|
46
66
|
|
|
47
|
-
|
|
67
|
+
---
|
|
48
68
|
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
69
|
+
## 🔍 What It Catches
|
|
70
|
+
|
|
71
|
+
CDK Insights scans for real problems across **35+ AWS services**:
|
|
72
|
+
|
|
73
|
+
| Category | Examples |
|
|
74
|
+
|----------|---------|
|
|
75
|
+
| **Security** | Public S3 buckets, wildcard IAM policies, unencrypted RDS/DynamoDB/SQS, open security groups |
|
|
76
|
+
| **Cost** | Over-provisioned Lambda memory, missing S3 lifecycle policies, unused resources |
|
|
77
|
+
| **Best Practices** | Missing CloudWatch alarms, no VPC flow logs, missing point-in-time recovery |
|
|
78
|
+
| **Compliance** | Encryption at rest, logging enabled, backup configuration |
|
|
79
|
+
|
|
80
|
+
**Services covered:** S3, IAM, Lambda, RDS, EC2, DynamoDB, SQS, SNS, CloudFront, ECS/Fargate, API Gateway, Cognito, KMS, Secrets Manager, Step Functions, CloudTrail, EventBridge, EBS, WAF, CloudWatch, Route53, ElastiCache, ECR, OpenSearch, VPC, EKS, and more.
|
|
53
81
|
|
|
54
82
|
---
|
|
55
83
|
|
|
56
|
-
##
|
|
84
|
+
## 📊 Output Formats
|
|
57
85
|
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
86
|
+
| Format | Use Case | Command |
|
|
87
|
+
|--------|----------|---------|
|
|
88
|
+
| **Table** | Terminal review (default) | `npx cdk-insights scan` |
|
|
89
|
+
| **JSON** | CI/CD pipelines, automation | `--output json` |
|
|
90
|
+
| **Markdown** | Reports, documentation | `--output markdown` |
|
|
91
|
+
| **Summary** | Quick overview | `--output summary` |
|
|
92
|
+
| **SARIF** | GitHub Code Scanning | `--output sarif` |
|
|
65
93
|
|
|
66
94
|
---
|
|
67
95
|
|
|
68
|
-
## 💡 Usage Examples
|
|
96
|
+
## 💡 Usage Examples
|
|
69
97
|
|
|
70
|
-
| Scenario
|
|
71
|
-
|
|
72
|
-
| Full project scan
|
|
73
|
-
| Security-only focus
|
|
74
|
-
| Markdown report
|
|
75
|
-
| CI/CD
|
|
76
|
-
| Create GitHub issue
|
|
98
|
+
| Scenario | Command |
|
|
99
|
+
|----------|---------|
|
|
100
|
+
| Full project scan | `npx cdk-insights scan --all --output summary` |
|
|
101
|
+
| Security-only focus | `npx cdk-insights scan --services IAM,S3,KMS --rule-filter Security` |
|
|
102
|
+
| Markdown report | `npx cdk-insights scan --output markdown > report.md` |
|
|
103
|
+
| CI/CD with fail gate | `npx cdk-insights scan --all --output json --fail-on-critical` |
|
|
104
|
+
| Create GitHub issue | `npx cdk-insights scan --output markdown --with-issue` |
|
|
77
105
|
|
|
78
106
|
---
|
|
79
107
|
|
|
80
108
|
## 🔄 CI/CD Integration
|
|
81
109
|
|
|
82
|
-
CDK Insights automatically detects CI environments (GitHub Actions, GitLab CI, Jenkins,
|
|
110
|
+
CDK Insights automatically detects CI environments (GitHub Actions, GitLab CI, Jenkins, CircleCI, AWS CodeBuild, and more) and adjusts behavior accordingly.
|
|
111
|
+
|
|
112
|
+
### GitHub Action
|
|
113
|
+
|
|
114
|
+
```yaml
|
|
115
|
+
- name: Run CDK Insights
|
|
116
|
+
uses: instance-labs/cdk-insights-action@v1
|
|
117
|
+
with:
|
|
118
|
+
license-key: ${{ secrets.CDK_INSIGHTS_LICENSE_KEY }}
|
|
119
|
+
fail-on-critical: true
|
|
120
|
+
```
|
|
121
|
+
|
|
122
|
+
The GitHub Action posts findings as **PR comments**, uploads **SARIF for Code Scanning**, and supports **configurable severity thresholds** for merge blocking.
|
|
123
|
+
|
|
124
|
+
### Manual CI Setup
|
|
83
125
|
|
|
84
126
|
```yaml
|
|
85
|
-
# GitHub Actions example
|
|
86
127
|
- name: Run CDK Insights
|
|
87
|
-
run: npx cdk-insights scan --fail-on-critical
|
|
128
|
+
run: npx cdk-insights scan --all --output json --fail-on-critical
|
|
88
129
|
env:
|
|
89
130
|
CDK_INSIGHTS_LICENSE_KEY: ${{ secrets.CDK_INSIGHTS_LICENSE_KEY }}
|
|
90
131
|
```
|
|
@@ -95,19 +136,17 @@ In CI mode, CDK Insights will:
|
|
|
95
136
|
- Skip interactive prompts
|
|
96
137
|
- Exit with code 1 on critical issues (with `--fail-on-critical`)
|
|
97
138
|
|
|
98
|
-
👉 [Full CI/CD Setup Guide →](https://github.com/instancelabs/cdk-insights/blob/main/docs/ci-setup.md)
|
|
99
|
-
|
|
100
139
|
---
|
|
101
140
|
|
|
102
|
-
## ⚙️ Configuration
|
|
141
|
+
## ⚙️ Configuration
|
|
103
142
|
|
|
104
|
-
|
|
143
|
+
Create a `.cdk-insights.json` in your project root, or run:
|
|
105
144
|
|
|
106
145
|
```bash
|
|
107
146
|
npx cdk-insights config setup
|
|
108
147
|
```
|
|
109
148
|
|
|
110
|
-
### Enhanced Analysis
|
|
149
|
+
### CDK Aspect (Enhanced Analysis)
|
|
111
150
|
|
|
112
151
|
For precise file/line metadata and richer context, add the aspect in your CDK app:
|
|
113
152
|
|
|
@@ -123,47 +162,49 @@ app.synth();
|
|
|
123
162
|
|
|
124
163
|
---
|
|
125
164
|
|
|
126
|
-
## 💰
|
|
165
|
+
## 💰 Pricing
|
|
166
|
+
|
|
167
|
+
| Plan | Price | What's Included |
|
|
168
|
+
|------|-------|-----------------|
|
|
169
|
+
| **Free** | £0 forever | Static analysis (100+ rules), JSON/Table/Markdown/SARIF output, multi-stack analysis, CLI access |
|
|
170
|
+
| **Pro** | £9.99/mo | Everything in Free + AI analysis (Bedrock), GitHub integration, dashboard, PDF reports, 10,000 resources/mo |
|
|
171
|
+
| **Team** | £7.99/member/mo | Everything in Pro + team management, shared configs, audit trails, 15,000 resources/member |
|
|
127
172
|
|
|
128
|
-
|
|
173
|
+
Static analysis is **free forever** — no trial, no credit card, no signup required.
|
|
129
174
|
|
|
130
|
-
|
|
131
|
-
- 🚀 **Pro** — AI-powered insights, unlimited scanning, team features
|
|
132
|
-
- 🏢 **Enterprise** — Advanced compliance, unlimited usage, and dedicated support
|
|
175
|
+
The AI tier adds deep analysis via AWS Bedrock: security analysis, findings categorised by Well-Architected Framework pillar, and context-aware recommendations.
|
|
133
176
|
|
|
134
|
-
👉 [View full pricing
|
|
177
|
+
👉 [View full pricing](https://cdkinsights.dev/pricing)
|
|
135
178
|
|
|
136
179
|
---
|
|
137
180
|
|
|
138
181
|
## 🧰 Requirements
|
|
139
182
|
|
|
140
|
-
- Node.js
|
|
183
|
+
- Node.js 22 or later
|
|
141
184
|
- AWS CDK v2 project
|
|
142
185
|
|
|
186
|
+
### Quick Compatibility Check
|
|
187
|
+
|
|
188
|
+
```bash
|
|
189
|
+
node --version # Should be 22+
|
|
190
|
+
ls cdk.json # Should exist in CDK project
|
|
191
|
+
```
|
|
192
|
+
|
|
143
193
|
---
|
|
144
194
|
|
|
145
195
|
## 🔧 Troubleshooting
|
|
146
196
|
|
|
147
197
|
### Cache Management
|
|
148
198
|
|
|
149
|
-
CDK Insights caches analysis results to speed up subsequent runs:
|
|
150
|
-
|
|
151
199
|
```bash
|
|
152
|
-
# Clear all caches
|
|
153
|
-
npx cdk-insights
|
|
154
|
-
|
|
155
|
-
# Check cache status
|
|
156
|
-
npx cdk-insights cache-status
|
|
157
|
-
|
|
158
|
-
# Run analysis without using cache
|
|
159
|
-
npx cdk-insights scan --no-cache
|
|
200
|
+
npx cdk-insights clear-cache # Clear all caches
|
|
201
|
+
npx cdk-insights cache-status # Check cache status
|
|
202
|
+
npx cdk-insights scan --no-cache # Run without cache
|
|
160
203
|
```
|
|
161
204
|
|
|
162
205
|
### Authentication Issues
|
|
163
206
|
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
1. Check your license key is correctly set: `echo $CDK_INSIGHTS_LICENSE_KEY`
|
|
207
|
+
1. Check your license key: `echo $CDK_INSIGHTS_LICENSE_KEY`
|
|
167
208
|
2. Clear the auth cache: `npx cdk-insights clear-cache`
|
|
168
209
|
3. Verify your internet connection
|
|
169
210
|
|
|
@@ -172,41 +213,16 @@ If you encounter license validation errors:
|
|
|
172
213
|
CDK Insights detects potentially sensitive data in your CloudFormation templates:
|
|
173
214
|
|
|
174
215
|
```bash
|
|
175
|
-
# Fail on sensitive data
|
|
176
|
-
npx cdk-insights scan --
|
|
177
|
-
|
|
178
|
-
# Warn but continue on sensitive data
|
|
179
|
-
npx cdk-insights scan --warn-sensitive
|
|
180
|
-
```
|
|
181
|
-
|
|
182
|
-
Configure detection in `.cdk-insights.json`:
|
|
183
|
-
|
|
184
|
-
```json
|
|
185
|
-
{
|
|
186
|
-
"sensitiveDataDetection": {
|
|
187
|
-
"enabled": true,
|
|
188
|
-
"warnOnly": false,
|
|
189
|
-
"allowPatterns": ["^test-"],
|
|
190
|
-
"ignoreProperties": ["Description"]
|
|
191
|
-
}
|
|
192
|
-
}
|
|
216
|
+
npx cdk-insights scan --fail-on-critical # Fail on sensitive data (default)
|
|
217
|
+
npx cdk-insights scan --warn-sensitive # Warn but continue
|
|
193
218
|
```
|
|
194
219
|
|
|
195
220
|
---
|
|
196
221
|
|
|
197
|
-
## 📚 Links
|
|
198
|
-
|
|
199
|
-
- [GitHub Repository & Issues](https://github.com/instancelabs/cdk-insights)
|
|
200
|
-
- [Documentation](https://github.com/instancelabs/cdk-insights/tree/main/docs)
|
|
201
|
-
- [Pricing & Tiers](https://cdkinsights.dev/#pricing)
|
|
202
|
-
- License: MIT
|
|
203
|
-
|
|
204
|
-
---
|
|
205
|
-
|
|
206
|
-
Start with:
|
|
207
|
-
|
|
208
|
-
```bash
|
|
209
|
-
npx cdk-insights scan
|
|
210
|
-
```
|
|
222
|
+
## 📚 Links
|
|
211
223
|
|
|
212
|
-
|
|
224
|
+
- **Website:** [cdkinsights.dev](https://cdkinsights.dev)
|
|
225
|
+
- **Documentation:** [cdkinsights.dev/docs](https://cdkinsights.dev/docs)
|
|
226
|
+
- **Pricing:** [cdkinsights.dev/pricing](https://cdkinsights.dev/pricing)
|
|
227
|
+
- **npm:** [npmjs.com/package/cdk-insights](https://www.npmjs.com/package/cdk-insights)
|
|
228
|
+
- **License:** [BSL 1.1](./LICENSE) (converts to Apache 2.0 on 2030-04-12)
|
|
@@ -56,6 +56,8 @@ export interface UserConfig {
|
|
|
56
56
|
local?: boolean;
|
|
57
57
|
warnSensitive?: boolean;
|
|
58
58
|
allowSensitive?: boolean;
|
|
59
|
+
/** Disable the interactive feedback prompt after analysis (default: true) */
|
|
60
|
+
feedback?: boolean;
|
|
59
61
|
/** Sensitive data detection configuration */
|
|
60
62
|
sensitiveDataDetection?: SensitiveDataDetectionConfig;
|
|
61
63
|
cache?: {
|