Skip to content

Bump io.github.cdklabs:cdknag from 2.38.2 to 3.0.1 in /labs/unicorn-store/infrastructure/cdk #1536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 2 commits into
base: main
Choose a base branch
from
+27 −30
Open

Bump io.github.cdklabs:cdknag from 2.38.2 to 3.0.1 in /labs/unicorn-store/infrastructure/cdk #1536

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b737ddf
Bump io.github.cdklabs:cdknag in /labs/unicorn-store/infrastructure/cdk
dependabot[bot] Jun 15, 2026
4af3206
Converted CdkNag to 3.0 structures
curtisms Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion labs/unicorn-store/infrastructure/cdk/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
<dependency>
<groupId>io.github.cdklabs</groupId>
<artifactId>cdknag</artifactId>
<version>2.38.2</version>
<version>3.0.1</version>
</dependency>

<dependency>
Expand Down
55 changes: 26 additions & 29 deletions labs/unicorn-store/infrastructure/cdk/src/main/java/com/unicorn/UnicornStoreApp.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
package com.unicorn;

import java.util.Collections;
import java.util.List;

import com.unicorn.alternatives.UnicornAuditService;
Expand All @@ -9,11 +10,7 @@
import com.unicorn.core.InfrastructureStack;

import io.github.cdklabs.cdknag.AwsSolutionsChecks;
import io.github.cdklabs.cdknag.NagPackSuppression;
import io.github.cdklabs.cdknag.NagSuppressions;
import software.amazon.awscdk.App;
import software.amazon.awscdk.Aspects;
import software.amazon.awscdk.StackProps;
import software.amazon.awscdk.*;

public class UnicornStoreApp {

Expand Down Expand Up @@ -41,33 +38,33 @@ public static void main(final String[] args) {

//Add CDK-NAG checks: https://github.com/cdklabs/cdk-nag
//Add suppression to exclude certain findings that are not needed for Workshop environment
Aspects.of(app).add(new AwsSolutionsChecks());
Validations.of(app).addPlugins(new AwsSolutionsChecks());
var suppression = List.of(
new NagPackSuppression.Builder().id("AwsSolutions-APIG4").reason("The workshop environment does not require API-Gateway authorization").build(),
new NagPackSuppression.Builder().id("AwsSolutions-COG4").reason("The workshop environment does not require Cognito User Pool authorization").build(),
new NagPackSuppression.Builder().id("AwsSolutions-RDS3").reason("Workshop environment does not need a Multi-AZ setup to reduce cost").build(),
new NagPackSuppression.Builder().id("AwsSolutions-IAM4").reason("AWS Managed policies are acceptable for the workshop").build(),
new NagPackSuppression.Builder().id("AwsSolutions-IAM5").reason("A wildcard is acceptable for this workshop to allow parallel creation of resources").build(),
new NagPackSuppression.Builder().id("AwsSolutions-RDS10").reason("Workshop environment is ephemeral and the database should be deleted by the end of the workshop").build(),
new NagPackSuppression.Builder().id("AwsSolutions-RDS11").reason("Database is in a private subnet and can use the default port").build(),
new NagPackSuppression.Builder().id("AwsSolutions-APIG2").reason("API Gateway request validation is not needed for workshop").build(),
new NagPackSuppression.Builder().id("AwsSolutions-APIG1").reason("API Gateway access logging not needed for workshop setup").build(),
new NagPackSuppression.Builder().id("AwsSolutions-APIG6").reason("API Gateway access logging not needed for workshop setup").build(),
new NagPackSuppression.Builder().id("AwsSolutions-VPC7").reason("Workshop environment does not need VPC flow logs").build(),
new NagPackSuppression.Builder().id("AwsSolutions-SMG4").reason("Ephemeral workshop environment does not need to rotate secrets").build(),
new NagPackSuppression.Builder().id("AwsSolutions-RDS2").reason("Workshop non-sensitive test database does not need encryption at rest").build(),
new NagPackSuppression.Builder().id("AwsSolutions-APIG3").reason("Workshop API Gateways do not need AWS WAF assigned").build(),
new NagPackSuppression.Builder().id("AwsSolutions-EC23").reason("Not needed").build(),
new NagPackSuppression.Builder().id("AwsSolutions-RDS13").reason("Workshop Database does not need backups").build(),
new NagPackSuppression.Builder().id("CdkNagValidationFailure").reason("Suppress warnings see: https://github.com/cdklabs/cdk-nag/issues/817").build()
new Acknowledgment.Builder().id("AwsSolutions-APIG4").reason("The workshop environment does not require API-Gateway authorization").build(),
new Acknowledgment.Builder().id("AwsSolutions-COG4").reason("The workshop environment does not require Cognito User Pool authorization").build(),
new Acknowledgment.Builder().id("AwsSolutions-RDS3").reason("Workshop environment does not need a Multi-AZ setup to reduce cost").build(),
new Acknowledgment.Builder().id("AwsSolutions-IAM4").reason("AWS Managed policies are acceptable for the workshop").build(),
new Acknowledgment.Builder().id("AwsSolutions-IAM5").reason("A wildcard is acceptable for this workshop to allow parallel creation of resources").build(),
new Acknowledgment.Builder().id("AwsSolutions-RDS10").reason("Workshop environment is ephemeral and the database should be deleted by the end of the workshop").build(),
new Acknowledgment.Builder().id("AwsSolutions-RDS11").reason("Database is in a private subnet and can use the default port").build(),
new Acknowledgment.Builder().id("AwsSolutions-APIG2").reason("API Gateway request validation is not needed for workshop").build(),
new Acknowledgment.Builder().id("AwsSolutions-APIG1").reason("API Gateway access logging not needed for workshop setup").build(),
new Acknowledgment.Builder().id("AwsSolutions-APIG6").reason("API Gateway access logging not needed for workshop setup").build(),
new Acknowledgment.Builder().id("AwsSolutions-VPC7").reason("Workshop environment does not need VPC flow logs").build(),
new Acknowledgment.Builder().id("AwsSolutions-SMG4").reason("Ephemeral workshop environment does not need to rotate secrets").build(),
new Acknowledgment.Builder().id("AwsSolutions-RDS2").reason("Workshop non-sensitive test database does not need encryption at rest").build(),
new Acknowledgment.Builder().id("AwsSolutions-APIG3").reason("Workshop API Gateways do not need AWS WAF assigned").build(),
new Acknowledgment.Builder().id("AwsSolutions-EC23").reason("Not needed").build(),
new Acknowledgment.Builder().id("AwsSolutions-RDS13").reason("Workshop Database does not need backups").build(),
new Acknowledgment.Builder().id("CdkNagValidationFailure").reason("Suppress warnings see: https://github.com/cdklabs/cdk-nag/issues/817").build()
);

NagSuppressions.addStackSuppressions(infrastructureStack, suppression);
NagSuppressions.addStackSuppressions(unicornStoreSpring, suppression);
NagSuppressions.addStackSuppressions(unicornStoreMicronaut, suppression);
NagSuppressions.addStackSuppressions(unicornStoreSpringGraalVM, suppression);
NagSuppressions.addStackSuppressions(unicornStoreQuarkus, suppression);
NagSuppressions.addStackSuppressions(unicornAuditService, suppression);
Validations.of(infrastructureStack).acknowledge(suppression.toArray(new Acknowledgment[0]));
Validations.of(unicornStoreSpring).acknowledge(suppression.toArray(new Acknowledgment[0]));
Validations.of(unicornStoreMicronaut).acknowledge(suppression.toArray(new Acknowledgment[0]));
Validations.of(unicornStoreSpringGraalVM).acknowledge(suppression.toArray(new Acknowledgment[0]));
Validations.of(unicornStoreQuarkus).acknowledge(suppression.toArray(new Acknowledgment[0]));
Validations.of(unicornAuditService).acknowledge(suppression.toArray(new Acknowledgment[0]));

app.synth();
}
Expand Down
Loading