def visit(self, node: IConstruct):
if isinstance(node, Function):
user_agent = json.dumps({
"user_agent_extra":
f"AwsSolution/{self.solution_id}/%%VERSION%%"
})
node.add_environment(key="AWS_SDK_USER_AGENT", value=user_agent)
def suppress_iam_cfnnag_rule(cnstrt: IConstruct):
cnstrt.add_metadata(
'cfn_nag', {
"rules_to_suppress":
[{
"id": "W12",
"reason": "by default the role scaler_sa has * resource"
}, {
"id": "W76",
"reason": "standard IAM role offered by ALB ingress controller"
}]
})
def suppress_network_cfnnag_rule(cnstrt: IConstruct):
cnstrt.add_metadata(
'cfn_nag', {
"rules_to_suppress":
[{
"id":
"W40",
"reason":
"Egress IP Protocol of -1 is default and generally considered OK"
}, {
"id": "W5",
"reason": "The Security Group with cidr open considered OK"
}]
})
def suppress_lambda_cfnnag_rule(cnstrt: IConstruct):
cnstrt.add_metadata(
'cfn_nag', {
"rules_to_suppress":
[{
"id":
"W58",
"reason":
"service role has permission to write logs to CloudWatch"
}, {
"id": "W89",
"reason": "interal function does not need to associate to VPC"
}, {
"id":
"W92",
"reason":
"Setting up ReservedConcurrentExecutions is out of reach with the internal function created by CDK"
}]
})
def visit(self, node: IConstruct):
if "is_cfn_element" in dir(node) and node.is_cfn_element(node):
node.cfn_options.condition = self.condition
elif "is_cfn_element" in dir(node.node.default_child):
node.node.default_child.cfn_options.condition = self.condition
def suppress_cfnnag_rule(rule_id: str, reason: str, cnstrt: IConstruct):
cnstrt.add_metadata(
'cfn_nag', {"rules_to_suppress": [{
"id": rule_id,
"reason": reason
}]})
def visit(self, node: core.IConstruct) -> None:
""" Function to implement a path pattern """
if isinstance(node, iam.CfnRole):
node.path = f"/{context.role_prefix}/" if context.role_prefix else "/"