cdk-nag 2.31.3__py3-none-any.whl → 2.32.0__py3-none-any.whl

cdk_nag/__init__.py

@@ -282,6 +282,67 @@ You would see the following error on synth/deploy
 
 </details>
 
+## Suppressing Rule Validation Failures
+
+When a rule validation fails it is handled similarly to a rule violation, and can be suppressed in the same manner. The `ID` for a rule failure is `CdkNagValidationFailure`.
+
+If a rule is suppressed in a non-granular manner (i.e. `appliesTo` is not set, see example 1 above) then validation failures on that rule are also suppressed.
+
+Validation failure suppression respects any applied [Suppression Ignore Conditions](#conditionally-ignoring-suppressions)
+
+<details>
+  <summary>Example 1) Suppress all Validation Failures on a Resource</summary>
+
+```python
+import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
+import { Stack, StackProps } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { NagSuppressions } from 'cdk-nag';
+
+export class CdkTestStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+    const test = new SecurityGroup(this, 'test', {
+      vpc: new Vpc(this, 'vpc'),
+    });
+    test.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
+    NagSuppressions.addResourceSuppressions(test, [
+      { id: 'CdkNagValidationFailure', reason: 'lorem ipsum' },
+    ]);
+  }
+}
+```
+
+</details><details>
+  <summary>Example 2) Granular Suppression of Validation Failures</summary>
+Validation failures can be suppressed for individual rules by using `appliesTo` to list the desired rules
+
+```python
+import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
+import { Stack, StackProps } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { NagSuppressions } from 'cdk-nag';
+
+export class CdkTestStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+    const test = new SecurityGroup(this, 'test', {
+      vpc: new Vpc(this, 'vpc'),
+    });
+    test.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
+    NagSuppressions.addResourceSuppressions(test, [
+      {
+        id: 'CdkNagValidationFailure',
+        reason: 'lorem ipsum',
+        appliesTo: ['AwsSolutions-L1'],
+      },
+    ]);
+  }
+}
+```
+
+</details>
+
 ## Suppressing `aws-cdk-lib/pipelines` Violations
 
 The [aws-cdk-lib/pipelines.CodePipeline](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines.CodePipeline.html) construct and its child constructs are not guaranteed to be "Visited" by `Aspects`, as they are not added during the "Construction" phase of the [cdk lifecycle](https://docs.aws.amazon.com/cdk/v2/guide/apps.html#lifecycle). Because of this behavior, you may experience problems such as rule violations not appearing or the inability to suppress violations on these constructs.
@@ -2231,6 +2292,7 @@ class NagPack(metaclass=jsii.JSIIAbstractClass, jsii_type="cdk-nag.NagPack"):
         resource: _aws_cdk_ceddda9d.CfnResource,
         level: NagMessageLevel,
         ignore_suppression_condition: typing.Optional[INagSuppressionIgnore] = None,
+        validation_failure: typing.Optional[builtins.bool] = None,
     ) -> builtins.str:
         '''Check whether a specific rule should be ignored.
 
@@ -2240,6 +2302,7 @@ class NagPack(metaclass=jsii.JSIIAbstractClass, jsii_type="cdk-nag.NagPack"):
         :param resource: The resource being evaluated.
         :param level: -
         :param ignore_suppression_condition: -
+        :param validation_failure: Whether the rule is being checked due to a validation failure.
 
         :return: The reason the rule was ignored, or an empty string.
         '''
@@ -2251,7 +2314,8 @@ class NagPack(metaclass=jsii.JSIIAbstractClass, jsii_type="cdk-nag.NagPack"):
             check_type(argname="argument resource", value=resource, expected_type=type_hints["resource"])
             check_type(argname="argument level", value=level, expected_type=type_hints["level"])
             check_type(argname="argument ignore_suppression_condition", value=ignore_suppression_condition, expected_type=type_hints["ignore_suppression_condition"])
-        return typing.cast(builtins.str, jsii.invoke(self, "ignoreRule", [suppressions, rule_id, finding_id, resource, level, ignore_suppression_condition]))
+            check_type(argname="argument validation_failure", value=validation_failure, expected_type=type_hints["validation_failure"])
+        return typing.cast(builtins.str, jsii.invoke(self, "ignoreRule", [suppressions, rule_id, finding_id, resource, level, ignore_suppression_condition, validation_failure]))
 
     @jsii.member(jsii_name="visit")
     @abc.abstractmethod
@@ -4193,6 +4257,7 @@ def _typecheckingstub__ba5c64d28918f6c81ac27ddb1b8fd172dcc8d60b93422df8be15366fb
     resource: _aws_cdk_ceddda9d.CfnResource,
     level: NagMessageLevel,
     ignore_suppression_condition: typing.Optional[INagSuppressionIgnore] = None,
+    validation_failure: typing.Optional[builtins.bool] = None,
 ) -> None:
     """Type checking stubs"""
     pass

cdk_nag/_jsii/__init__.py

@@ -32,7 +32,7 @@ import aws_cdk._jsii
 import constructs._jsii
 
 __jsii_assembly__ = jsii.JSIIAssembly.load(
-    "cdk-nag", "2.31.3", __name__[0:-6], "cdk-nag@2.31.3.jsii.tgz"
+    "cdk-nag", "2.32.0", __name__[0:-6], "cdk-nag@2.32.0.jsii.tgz"
 )
 
 __all__ = [

{cdk_nag-2.31.3.dist-info → cdk_nag-2.32.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cdk-nag
-Version: 2.31.3
+Version: 2.32.0
 Summary: Check CDK v2 applications for best practices using a combination on available rule packs.
 Home-page: https://github.com/cdklabs/cdk-nag.git
 Author: Arun Donti<donti@amazon.com>
@@ -310,6 +310,67 @@ You would see the following error on synth/deploy
 
 </details>
 
+## Suppressing Rule Validation Failures
+
+When a rule validation fails it is handled similarly to a rule violation, and can be suppressed in the same manner. The `ID` for a rule failure is `CdkNagValidationFailure`.
+
+If a rule is suppressed in a non-granular manner (i.e. `appliesTo` is not set, see example 1 above) then validation failures on that rule are also suppressed.
+
+Validation failure suppression respects any applied [Suppression Ignore Conditions](#conditionally-ignoring-suppressions)
+
+<details>
+  <summary>Example 1) Suppress all Validation Failures on a Resource</summary>
+
+```python
+import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
+import { Stack, StackProps } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { NagSuppressions } from 'cdk-nag';
+
+export class CdkTestStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+    const test = new SecurityGroup(this, 'test', {
+      vpc: new Vpc(this, 'vpc'),
+    });
+    test.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
+    NagSuppressions.addResourceSuppressions(test, [
+      { id: 'CdkNagValidationFailure', reason: 'lorem ipsum' },
+    ]);
+  }
+}
+```
+
+</details><details>
+  <summary>Example 2) Granular Suppression of Validation Failures</summary>
+Validation failures can be suppressed for individual rules by using `appliesTo` to list the desired rules
+
+```python
+import { SecurityGroup, Vpc, Peer, Port } from 'aws-cdk-lib/aws-ec2';
+import { Stack, StackProps } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { NagSuppressions } from 'cdk-nag';
+
+export class CdkTestStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+    const test = new SecurityGroup(this, 'test', {
+      vpc: new Vpc(this, 'vpc'),
+    });
+    test.addIngressRule(Peer.anyIpv4(), Port.allTraffic());
+    NagSuppressions.addResourceSuppressions(test, [
+      {
+        id: 'CdkNagValidationFailure',
+        reason: 'lorem ipsum',
+        appliesTo: ['AwsSolutions-L1'],
+      },
+    ]);
+  }
+}
+```
+
+</details>
+
 ## Suppressing `aws-cdk-lib/pipelines` Violations
 
 The [aws-cdk-lib/pipelines.CodePipeline](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines.CodePipeline.html) construct and its child constructs are not guaranteed to be "Visited" by `Aspects`, as they are not added during the "Construction" phase of the [cdk lifecycle](https://docs.aws.amazon.com/cdk/v2/guide/apps.html#lifecycle). Because of this behavior, you may experience problems such as rule violations not appearing or the inability to suppress violations on these constructs.

cdk_nag-2.32.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+cdk_nag/__init__.py,sha256=gFC-zoqJD8upXEQ8U9NYkkC8FyENY2SE5J7Xio58h8Q,171218
+cdk_nag/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
+cdk_nag/_jsii/__init__.py,sha256=VpcQ--_P7VXRZHHK_AXbjwcBxIAP8dHQbTIpXKsqYyk,1427
+cdk_nag/_jsii/cdk-nag@2.32.0.jsii.tgz,sha256=V0piSvpls1wXuBscZTnOOF8hvclJhCJ5i9XZv_7bvgo,692613
+cdk_nag-2.32.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+cdk_nag-2.32.0.dist-info/METADATA,sha256=-9KadpwWlYssUAKr5w6436Zm6QLYa4_RvFTZtOqUuSU,23256
+cdk_nag-2.32.0.dist-info/NOTICE,sha256=iY5F0xzQe4KtUQk3HOYeKSkIN2Xty0Y_tmkXNX4mzdw,105
+cdk_nag-2.32.0.dist-info/WHEEL,sha256=eOLhNAGa2EW3wWl_TU484h7q1UNgy0JXjjoqKoxAAQc,92
+cdk_nag-2.32.0.dist-info/top_level.txt,sha256=uA4ZNR24n8x6ieIX39y6e7sTFkC--8tF78mNKV88Ce0,8
+cdk_nag-2.32.0.dist-info/RECORD,,

cdk_nag-2.31.3.dist-info/RECORD

@@ -1,10 +0,0 @@
-cdk_nag/__init__.py,sha256=gRIpacfeNRkTcFqno_YfKlmM3CZ4upgCMeHKBtMK1yc,168693
-cdk_nag/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
-cdk_nag/_jsii/__init__.py,sha256=s93Mos_juG5zwLw1CgzmKcPG_k2_XnENm537rY62Sb0,1427
-cdk_nag/_jsii/cdk-nag@2.31.3.jsii.tgz,sha256=p288I_vO2Bw6XdGAuGOuAAoHsPlZNhjJSjtgwQ3NwG4,691677
-cdk_nag-2.31.3.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-cdk_nag-2.31.3.dist-info/METADATA,sha256=iciUW9ePD5OJQPg9wQtyGcufEcIMXdRqm2DXsQmVhqY,21115
-cdk_nag-2.31.3.dist-info/NOTICE,sha256=iY5F0xzQe4KtUQk3HOYeKSkIN2Xty0Y_tmkXNX4mzdw,105
-cdk_nag-2.31.3.dist-info/WHEEL,sha256=eOLhNAGa2EW3wWl_TU484h7q1UNgy0JXjjoqKoxAAQc,92
-cdk_nag-2.31.3.dist-info/top_level.txt,sha256=uA4ZNR24n8x6ieIX39y6e7sTFkC--8tF78mNKV88Ce0,8
-cdk_nag-2.31.3.dist-info/RECORD,,