cdk-insights 1.2.6 → 1.2.9

package/dist/helpers/sensitiveDataDetection/patterns.d.ts

@@ -26,6 +26,61 @@ export declare const SAFE_REFERENCE_PATTERNS: RegExp[];
  * These are common patterns developers use as placeholders.
  */
 export declare const PLACEHOLDER_PATTERNS: RegExp[];
+/**
+ * Property names whose values are categorically non-sensitive regardless
+ * of their shape. These are CloudFormation resource identifiers (names,
+ * IDs) and human-readable metadata (descriptions, labels) — the values
+ * may look entropy-ish (auto-generated hashes in CDK resource names,
+ * long English alarm descriptions) but never contain secret material.
+ *
+ * If the scanner is tempted to flag one of these by its value alone,
+ * short-circuit: the property name is load-bearing and tells us the
+ * answer already.
+ *
+ * Case-insensitive exact-match only — if you want substring behaviour
+ * use SENSITIVE_PROPERTY_NAME_PATTERNS.
+ */
+export declare const NEVER_SENSITIVE_PROPERTY_NAMES: RegExp[];
+/**
+ * CDK auto-generates resource names by concatenating the stack name,
+ * construct path, and an eight-hex-char deterministic hash. The result
+ * looks like `CognitoAuthRoledevDefaultPolicy48B1EEFF` — mixed case,
+ * alphanumeric, >16 chars, satisfies the entropy heuristic, but is not
+ * a secret. Every CDK stack produces these for every IAM DefaultPolicy,
+ * Lambda ServiceRole, etc., so this is a universal false-positive
+ * shape worth calling out explicitly.
+ *
+ * Matches: any string ending with a recognised CDK naming suffix
+ * followed by an 8+ hex character hash.
+ */
+export declare const CDK_GENERATED_NAME_PATTERN: RegExp;
+/**
+ * Property paths (relative to a CloudFormation resource's Properties
+ * block) whose values are structured payloads — JSON blobs, state
+ * machine definitions, custom-resource handler config. Scanning these
+ * as raw strings trips the entropy heuristic because well-formed JSON
+ * is lexically dense. These are known-safe by construction.
+ */
+export declare const NON_SENSITIVE_STRUCTURED_PATH_SUFFIXES: RegExp[];
+/**
+ * Check if a property name is categorically non-sensitive regardless
+ * of its value. Used to short-circuit the scanner on well-known
+ * CloudFormation name/description properties.
+ */
+export declare const isAlwaysNonSensitiveProperty: (propertyName: string) => boolean;
+/**
+ * Check if a value looks like a CDK-auto-generated resource name.
+ * Relies on CDK's naming convention (construct path + 8+ char hash
+ * suffix) to identify synth-time identifiers that would otherwise
+ * trip the entropy check.
+ */
+export declare const isCdkGeneratedName: (value: string) => boolean;
+/**
+ * Check if a property path references a known structured payload
+ * (JSON blob, state machine definition, custom resource config) whose
+ * value is non-sensitive by construction.
+ */
+export declare const isNonSensitiveStructuredPath: (propertyPath: string) => boolean;
 /**
  * Check if a property name suggests sensitive data
  */

package/dist/helpers/sensitiveDataDetection/types.d.ts

@@ -22,6 +22,39 @@ export interface SensitiveDataFinding {
     detectionReasonMessage: string;
     /** Recommended secure alternative */
     recommendation: string;
+    /**
+     * Diagnostic metadata about the flagged value. Populated so users can
+     * triage findings without the scanner revealing the full value.
+     */
+    diagnostics?: SensitiveDataDiagnostics;
+}
+/**
+ * Privacy-preserving diagnostic metadata attached to each finding.
+ *
+ * The scanner must never emit the full flagged value (it's potentially
+ * a real secret). But users triaging false positives need enough signal
+ * to recognise what was flagged — especially important for CDK-generated
+ * names and other structural false positives where the length + shape
+ * immediately identifies the value. The fields here walk that line.
+ */
+export interface SensitiveDataDiagnostics {
+    /** Length of the flagged value in characters */
+    valueLength: number;
+    /**
+     * Partial preview: first 4 and last 4 chars joined by an ellipsis
+     * (e.g. `Cogn…EEFF`) when the value is long enough for this to be
+     * safe. Returns null for values under 20 chars — too short to reveal
+     * any portion safely.
+     */
+    valueShape: string | null;
+    /** Shannon entropy in bits/char (only set for high_entropy detections) */
+    entropy?: number;
+    /** The threshold the entropy exceeded */
+    entropyThreshold?: number;
+    /** Which sensitive-property-name pattern matched (property_name detections) */
+    matchedPropertyPattern?: string;
+    /** Which secret-value pattern matched (value_pattern detections) */
+    matchedValuePattern?: string;
 }
 /**
  * Result of scanning a single resource for sensitive data