From b737ddfda180d55636b0f856b9994f55e078d97f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 15 Jun 2026 09:33:44 +0000 Subject: [PATCH 1/2] Bump io.github.cdklabs:cdknag in /labs/unicorn-store/infrastructure/cdk Bumps [io.github.cdklabs:cdknag](https://github.com/cdklabs/cdk-nag) from 2.38.2 to 3.0.1. - [Release notes](https://github.com/cdklabs/cdk-nag/releases) - [Commits](https://github.com/cdklabs/cdk-nag/compare/v2.38.2...v3.0.1) --- updated-dependencies: - dependency-name: io.github.cdklabs:cdknag dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- labs/unicorn-store/infrastructure/cdk/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/labs/unicorn-store/infrastructure/cdk/pom.xml b/labs/unicorn-store/infrastructure/cdk/pom.xml index efa27f7f..ff59c506 100644 --- a/labs/unicorn-store/infrastructure/cdk/pom.xml +++ b/labs/unicorn-store/infrastructure/cdk/pom.xml @@ -48,7 +48,7 @@ io.github.cdklabs cdknag - 2.38.2 + 3.0.1 From 4af3206de9a018544c3e651fcb158da0713c1e49 Mon Sep 17 00:00:00 2001 From: Mark Curtis Date: Mon, 6 Jul 2026 16:54:35 -0400 Subject: [PATCH 2/2] Converted CdkNag to 3.0 structures --- .../java/com/unicorn/UnicornStoreApp.java | 55 +++++++++---------- 1 file changed, 26 insertions(+), 29 deletions(-) diff --git a/labs/unicorn-store/infrastructure/cdk/src/main/java/com/unicorn/UnicornStoreApp.java b/labs/unicorn-store/infrastructure/cdk/src/main/java/com/unicorn/UnicornStoreApp.java index fe38c4cd..86c7a316 100644 --- a/labs/unicorn-store/infrastructure/cdk/src/main/java/com/unicorn/UnicornStoreApp.java +++ b/labs/unicorn-store/infrastructure/cdk/src/main/java/com/unicorn/UnicornStoreApp.java @@ -1,5 +1,6 @@ package com.unicorn; +import java.util.Collections; import java.util.List; import com.unicorn.alternatives.UnicornAuditService; @@ -9,11 +10,7 @@ import com.unicorn.core.InfrastructureStack; import io.github.cdklabs.cdknag.AwsSolutionsChecks; -import io.github.cdklabs.cdknag.NagPackSuppression; -import io.github.cdklabs.cdknag.NagSuppressions; -import software.amazon.awscdk.App; -import software.amazon.awscdk.Aspects; -import software.amazon.awscdk.StackProps; +import software.amazon.awscdk.*; public class UnicornStoreApp { @@ -41,33 +38,33 @@ public static void main(final String[] args) { //Add CDK-NAG checks: https://github.com/cdklabs/cdk-nag //Add suppression to exclude certain findings that are not needed for Workshop environment - Aspects.of(app).add(new AwsSolutionsChecks()); + Validations.of(app).addPlugins(new AwsSolutionsChecks()); var suppression = List.of( - new NagPackSuppression.Builder().id("AwsSolutions-APIG4").reason("The workshop environment does not require API-Gateway authorization").build(), - new NagPackSuppression.Builder().id("AwsSolutions-COG4").reason("The workshop environment does not require Cognito User Pool authorization").build(), - new NagPackSuppression.Builder().id("AwsSolutions-RDS3").reason("Workshop environment does not need a Multi-AZ setup to reduce cost").build(), - new NagPackSuppression.Builder().id("AwsSolutions-IAM4").reason("AWS Managed policies are acceptable for the workshop").build(), - new NagPackSuppression.Builder().id("AwsSolutions-IAM5").reason("A wildcard is acceptable for this workshop to allow parallel creation of resources").build(), - new NagPackSuppression.Builder().id("AwsSolutions-RDS10").reason("Workshop environment is ephemeral and the database should be deleted by the end of the workshop").build(), - new NagPackSuppression.Builder().id("AwsSolutions-RDS11").reason("Database is in a private subnet and can use the default port").build(), - new NagPackSuppression.Builder().id("AwsSolutions-APIG2").reason("API Gateway request validation is not needed for workshop").build(), - new NagPackSuppression.Builder().id("AwsSolutions-APIG1").reason("API Gateway access logging not needed for workshop setup").build(), - new NagPackSuppression.Builder().id("AwsSolutions-APIG6").reason("API Gateway access logging not needed for workshop setup").build(), - new NagPackSuppression.Builder().id("AwsSolutions-VPC7").reason("Workshop environment does not need VPC flow logs").build(), - new NagPackSuppression.Builder().id("AwsSolutions-SMG4").reason("Ephemeral workshop environment does not need to rotate secrets").build(), - new NagPackSuppression.Builder().id("AwsSolutions-RDS2").reason("Workshop non-sensitive test database does not need encryption at rest").build(), - new NagPackSuppression.Builder().id("AwsSolutions-APIG3").reason("Workshop API Gateways do not need AWS WAF assigned").build(), - new NagPackSuppression.Builder().id("AwsSolutions-EC23").reason("Not needed").build(), - new NagPackSuppression.Builder().id("AwsSolutions-RDS13").reason("Workshop Database does not need backups").build(), - new NagPackSuppression.Builder().id("CdkNagValidationFailure").reason("Suppress warnings see: https://github.com/cdklabs/cdk-nag/issues/817").build() + new Acknowledgment.Builder().id("AwsSolutions-APIG4").reason("The workshop environment does not require API-Gateway authorization").build(), + new Acknowledgment.Builder().id("AwsSolutions-COG4").reason("The workshop environment does not require Cognito User Pool authorization").build(), + new Acknowledgment.Builder().id("AwsSolutions-RDS3").reason("Workshop environment does not need a Multi-AZ setup to reduce cost").build(), + new Acknowledgment.Builder().id("AwsSolutions-IAM4").reason("AWS Managed policies are acceptable for the workshop").build(), + new Acknowledgment.Builder().id("AwsSolutions-IAM5").reason("A wildcard is acceptable for this workshop to allow parallel creation of resources").build(), + new Acknowledgment.Builder().id("AwsSolutions-RDS10").reason("Workshop environment is ephemeral and the database should be deleted by the end of the workshop").build(), + new Acknowledgment.Builder().id("AwsSolutions-RDS11").reason("Database is in a private subnet and can use the default port").build(), + new Acknowledgment.Builder().id("AwsSolutions-APIG2").reason("API Gateway request validation is not needed for workshop").build(), + new Acknowledgment.Builder().id("AwsSolutions-APIG1").reason("API Gateway access logging not needed for workshop setup").build(), + new Acknowledgment.Builder().id("AwsSolutions-APIG6").reason("API Gateway access logging not needed for workshop setup").build(), + new Acknowledgment.Builder().id("AwsSolutions-VPC7").reason("Workshop environment does not need VPC flow logs").build(), + new Acknowledgment.Builder().id("AwsSolutions-SMG4").reason("Ephemeral workshop environment does not need to rotate secrets").build(), + new Acknowledgment.Builder().id("AwsSolutions-RDS2").reason("Workshop non-sensitive test database does not need encryption at rest").build(), + new Acknowledgment.Builder().id("AwsSolutions-APIG3").reason("Workshop API Gateways do not need AWS WAF assigned").build(), + new Acknowledgment.Builder().id("AwsSolutions-EC23").reason("Not needed").build(), + new Acknowledgment.Builder().id("AwsSolutions-RDS13").reason("Workshop Database does not need backups").build(), + new Acknowledgment.Builder().id("CdkNagValidationFailure").reason("Suppress warnings see: https://github.com/cdklabs/cdk-nag/issues/817").build() ); - NagSuppressions.addStackSuppressions(infrastructureStack, suppression); - NagSuppressions.addStackSuppressions(unicornStoreSpring, suppression); - NagSuppressions.addStackSuppressions(unicornStoreMicronaut, suppression); - NagSuppressions.addStackSuppressions(unicornStoreSpringGraalVM, suppression); - NagSuppressions.addStackSuppressions(unicornStoreQuarkus, suppression); - NagSuppressions.addStackSuppressions(unicornAuditService, suppression); + Validations.of(infrastructureStack).acknowledge(suppression.toArray(new Acknowledgment[0])); + Validations.of(unicornStoreSpring).acknowledge(suppression.toArray(new Acknowledgment[0])); + Validations.of(unicornStoreMicronaut).acknowledge(suppression.toArray(new Acknowledgment[0])); + Validations.of(unicornStoreSpringGraalVM).acknowledge(suppression.toArray(new Acknowledgment[0])); + Validations.of(unicornStoreQuarkus).acknowledge(suppression.toArray(new Acknowledgment[0])); + Validations.of(unicornAuditService).acknowledge(suppression.toArray(new Acknowledgment[0])); app.synth(); }