cdk-insights 1.2.10 → 1.4.0

package/README.md

@@ -160,6 +160,32 @@ Aspects.of(app).add(new CdkInsightsAspect());
 app.synth();
 ```
 
+### Suppressing Findings
+
+Two channels, both feed into the same scan output, SARIF, severity counts, and PR comments:
+
+**Project-wide** — add `ignoreRules` and `ignorePaths` to `.cdk-insights.json`. Trailing `*` wildcards supported.
+
+```json
+{
+  "ignoreRules": ["CDK-INSIGHTS-SENSITIVE-*"],
+  "ignorePaths": ["MyStack/MarketingSite/*"]
+}
+```
+
+**Inline** (CDK ≥ 2.252.0) — acknowledge a finding next to the construct that triggered it, with a reason captured for audit:
+
+```ts
+import { Validations } from 'aws-cdk-lib';
+
+Validations.of(myBucket).acknowledge({
+  id: 'cdk-insights::s3-bucket-public-access',
+  reason: 'Public-by-design marketing site',
+});
+```
+
+Acknowledgements cascade to descendant constructs, so scope them as narrowly as the situation allows. See [Suppressing Findings](https://github.com/instancelabs/cdk-insights/blob/main/docs/configuration.md#suppressing-findings) for details.
+
 ---
 
 ## 💰 Pricing

package/dist/cli/types/cli.types.d.ts

@@ -12,6 +12,8 @@ export interface AnalyzeCommandArgs {
     reset?: boolean;
     failOnCritical?: boolean;
     ruleFilter?: string[];
+    ignoreRules?: string[];
+    ignorePaths?: string[];
     github?: boolean;
     redact?: boolean;
     summaryOnly?: boolean;
@@ -60,6 +62,22 @@ export interface UserConfig {
     feedback?: boolean;
     /** Sensitive data detection configuration */
     sensitiveDataDetection?: SensitiveDataDetectionConfig;
+    /**
+     * Rule IDs to suppress project-wide. Matched against `Issue.ruleId`
+     * — supports exact match or a trailing `*` wildcard (e.g.
+     * `CDK-INSIGHTS-SENSITIVE-*` suppresses every sensitive-data finding).
+     * Use this to silence rules that don't apply to your architecture
+     * instead of patching each call site.
+     */
+    ignoreRules?: string[];
+    /**
+     * Resource paths (CDK construct paths or logical IDs) to skip entirely.
+     * Matched against the resource's `aws:cdk:path` Metadata and its
+     * logical ID — supports exact match or trailing `*` wildcard. Use
+     * this to carve out a subtree of the template (e.g. an imported
+     * third-party construct whose findings are someone else's problem).
+     */
+    ignorePaths?: string[];
     cache?: {
         enabled?: boolean;
         ttl?: number;