cdk-validator-cfnguard icon indicating copy to clipboard operation
cdk-validator-cfnguard copied to clipboard

Add the option to suppress a Rule for a single construct

Open gianlucb opened this issue 10 months ago • 0 comments

I'm evaluating to move from CDK_NAG to this library, but found some missing functionalities. In CDK_NAG is possible to suppress a rule for a given construct (or path):

NagSuppressions.addResourceSuppressions(test, [{ id: 'AwsSolutions-EC23', reason: 'lorem ipsum' }, ]);

I cannot find a way to do the same here.

A common use case:

You create two S3 buckets, the first has the Logging configured to store the logs in the second bucket (B1-->B2); the second bucket does not have any logging configuration, as being used as access logging bucket.

The second bucket will fail with:

[CT.S3.PR.2]: Require an Amazon S3 bucket to have server access logging configured

I cannot configure the logging for this second bucket, as it will requires a third one, 4th...

The only way is to instruct the library to ignore this rule for the second bucket, but not the other ones.

gianlucb avatar Apr 05 '24 17:04 gianlucb