cdk-insights 1.3.0 → 1.5.0

package/README.md

@@ -160,6 +160,34 @@ Aspects.of(app).add(new CdkInsightsAspect());
 app.synth();
 ```
 
+Run synth with `CDK_DEBUG=true` so CDK records stack traces for each construct. On `aws-cdk-lib` ≥ 2.252.0, findings on deferred or post-construction property assignments (lifecycle rules, env vars, role policies, `Lazy.string`/`Lazy.any` values) now point at the property setter line — not the construct constructor — automatically. Older CDKs continue to work; you'll just get construct-level attribution.
+
+### Suppressing Findings
+
+Two channels, both feed into the same scan output, SARIF, severity counts, and PR comments:
+
+**Project-wide** — add `ignoreRules` and `ignorePaths` to `.cdk-insights.json`. Trailing `*` wildcards supported.
+
+```json
+{
+  "ignoreRules": ["CDK-INSIGHTS-SENSITIVE-*"],
+  "ignorePaths": ["MyStack/MarketingSite/*"]
+}
+```
+
+**Inline** (CDK ≥ 2.252.0) — acknowledge a finding next to the construct that triggered it, with a reason captured for audit:
+
+```ts
+import { Validations } from 'aws-cdk-lib';
+
+Validations.of(myBucket).acknowledge({
+  id: 'cdk-insights::s3-bucket-public-access',
+  reason: 'Public-by-design marketing site',
+});
+```
+
+Acknowledgements cascade to descendant constructs, so scope them as narrowly as the situation allows. See [Suppressing Findings](https://github.com/instancelabs/cdk-insights/blob/main/docs/configuration.md#suppressing-findings) for details.
+
 ---
 
 ## 💰 Pricing