【AWS CDK】豊富なルールセットでコンプライアンスチェックができるcdk-nagを試してみた

mkdir cdk-nag-test
cd cdk-nag-test
cdk init app --language typescript

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import { Bucket } from "aws-cdk-lib/aws-s3";

export class CdkNagTestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    const bucket = new Bucket(this, "Bucket");
  }
}

npm install cdk-nag

#!/usr/bin/env node
import "source-map-support/register";
import * as cdk from "aws-cdk-lib";
import { CdkNagTestStack } from "../lib/cdk-nag-test-stack";
import { AwsSolutionsChecks } from "cdk-nag";
import { Aspects } from "aws-cdk-lib";
import "source-map-support/register";

const app = new cdk.App();
Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));
new CdkNagTestStack(app, "CdkNagTestStack", {});

❯ npx cdk synth
[Error at /CdkNagTestStack/Bucket/Resource] AwsSolutions-S1: The S3 Bucket has server access logs disabled. The bucket should have server access logging enabled to provide detailed records for the requests that are made to the bucket.

[Error at /CdkNagTestStack/Bucket/Resource] AwsSolutions-S10: The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.

Found errors

Rule ID,Resource ID,Compliance,Exception Reason,Rule Level,Rule Info
"AwsSolutions-S1","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket has server access logs disabled."
"AwsSolutions-S2","CdkNagTestStack/Bucket/Resource","Compliant","N/A","Error","The S3 Bucket does not have public access restricted and blocked."
"AwsSolutions-S5","CdkNagTestStack/Bucket/Resource","Compliant","N/A","Error","The S3 static website bucket either has an open world bucket policy or does not use a CloudFront Origin Access Identity (OAI) in the bucket policy for limited getObject and/or putObject permissions."
"AwsSolutions-S10","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket or bucket policy does not require requests to use SSL."

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import { Bucket } from "aws-cdk-lib/aws-s3";
+import { NagSuppressions } from "cdk-nag";

export class CdkNagTestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
+    NagSuppressions.addStackSuppressions(this, [
+      {
+        id: "AwsSolutions-S1",
+        reason: "Demonstrate a stack level suppression.",
+      },
+    ]);
    const bucket = new Bucket(this, "Bucket");
  }
}

❯ npx cdk synth
[Error at /CdkNagTestStack/Bucket/Resource] AwsSolutions-S10: The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.

Found errors

Rule ID,Resource ID,Compliance,Exception Reason,Rule Level,Rule Info
"AwsSolutions-S1","CdkNagTestStack/Bucket/Resource","Suppressed","Demonstrate a stack level suppression.","Error","The S3 Bucket has server access logs disabled."
"AwsSolutions-S2","CdkNagTestStack/Bucket/Resource","Compliant","N/A","Error","The S3 Bucket does not have public access restricted and blocked."
"AwsSolutions-S5","CdkNagTestStack/Bucket/Resource","Compliant","N/A","Error","The S3 static website bucket either has an open world bucket policy or does not use a CloudFront Origin Access Identity (OAI) in the bucket policy for limited getObject and/or putObject permissions."
"AwsSolutions-S10","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket or bucket policy does not require requests to use SSL."

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import { Bucket } from "aws-cdk-lib/aws-s3";
import { NagSuppressions } from "cdk-nag";

export class CdkNagTestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    NagSuppressions.addStackSuppressions(this, [
      {
        id: "AwsSolutions-S1",
        reason: "Demonstrate a stack level suppression.",
      },
    ]);
-    const bucket = new Bucket(this, "Bucket");
+    const bucket = new Bucket(this, "Bucket", {
+      enforceSSL: true,
+    });
  }
}

#!/usr/bin/env node
import "source-map-support/register";
import * as cdk from "aws-cdk-lib";
import { CdkNagTestStack } from "../lib/cdk-nag-test-stack";
- import { AwsSolutionsChecks } from "cdk-nag";
+ import { HIPAASecurityChecks } from "cdk-nag";
import { Aspects } from "aws-cdk-lib";
import "source-map-support/register";

const app = new cdk.App();
- Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));
+ Aspects.of(app).add(new HIPAASecurityChecks({ verbose: true }));
new CdkNagTestStack(app, "CdkNagTestStack", {});

❯ npx cdk synth
[Error at /CdkNagTestStack/Bucket/Resource] HIPAA.Security-S3BucketLoggingEnabled: The S3 Bucket does not have server access logs enabled - (Control IDs: 164.308(a)(3)(ii)(A), 164.312(b)). Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.

[Error at /CdkNagTestStack/Bucket/Resource] HIPAA.Security-S3BucketPublicReadProhibited: The S3 Bucket does not prohibit public read access through its Block Public Access configurations and bucket ACLs - (Control IDs: 164.308(a)(3)(i), 164.308(a)(4)(ii)(A), 164.308(a)(4)(ii)(C), 164.312(a)(1), 164.312(e)(1)). The management of access should be consistent with the classification of the data.

[Error at /CdkNagTestStack/Bucket/Resource] HIPAA.Security-S3BucketPublicWriteProhibited: The S3 Bucket does not prohibit public write access through its Block Public Access configurations and bucket ACLs - (Control IDs: 164.308(a)(3)(i), 164.308(a)(4)(ii)(A), 164.308(a)(4)(ii)(C), 164.312(a)(1), 164.312(e)(1)). The management of access should be consistent with the classification of the data.

[Error at /CdkNagTestStack/Bucket/Resource] HIPAA.Security-S3BucketReplicationEnabled: The S3 Bucket does not have replication enabled - (Control IDs: 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.308(a)(7)(ii)(B)). Amazon Simple Storage Service (Amazon S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability. CRR enables automatic, asynchronous copying of objects across Amazon S3 buckets to help ensure that data availability is maintained.

[Error at /CdkNagTestStack/Bucket/Resource] HIPAA.Security-S3BucketVersioningEnabled: The S3 Bucket does not have versioning enabled - (Control IDs: 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.308(a)(7)(ii)(B), 164.312(c)(1), 164.312(c)(2)). Use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. Versioning helps you to easily recover from unintended user actions and application failures.

[Error at /CdkNagTestStack/Bucket/Resource] HIPAA.Security-S3DefaultEncryptionKMS: The S3 Bucket is not encrypted with a KMS Key by default - (Control IDs: 164.312(a)(2)(iv), 164.312(e)(2)(ii)). Ensure that encryption is enabled for your Amazon Simple Storage Service (Amazon S3) buckets. Because sensitive data can exist at rest in an Amazon S3 bucket, enable encryption at rest to help protect that data.

Found errors

Rule ID,Resource ID,Compliance,Exception Reason,Rule Level,Rule Info
"HIPAA.Security-S3BucketLevelPublicAccessProhibited","CdkNagTestStack/Bucket/Resource","Compliant","N/A","Error","The S3 bucket does not prohibit public access through bucket level settings - (Control IDs: 164.308(a)(3)(i), 164.308(a)(4)(ii)(A), 164.308(a)(4)(ii)(C), 164.312(a)(1), 164.312(e)(1))."
"HIPAA.Security-S3BucketLoggingEnabled","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket does not have server access logs enabled - (Control IDs: 164.308(a)(3)(ii)(A), 164.312(b))."
"HIPAA.Security-S3BucketPublicReadProhibited","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket does not prohibit public read access through its Block Public Access configurations and bucket ACLs - (Control IDs: 164.308(a)(3)(i), 164.308(a)(4)(ii)(A), 164.308(a)(4)(ii)(C), 164.312(a)(1), 164.312(e)(1))."
"HIPAA.Security-S3BucketPublicWriteProhibited","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket does not prohibit public write access through its Block Public Access configurations and bucket ACLs - (Control IDs: 164.308(a)(3)(i), 164.308(a)(4)(ii)(A), 164.308(a)(4)(ii)(C), 164.312(a)(1), 164.312(e)(1))."
"HIPAA.Security-S3BucketReplicationEnabled","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket does not have replication enabled - (Control IDs: 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.308(a)(7)(ii)(B))."
"HIPAA.Security-S3BucketSSLRequestsOnly","CdkNagTestStack/Bucket/Resource","Compliant","N/A","Error","The S3 Bucket or bucket policy does not require requests to use SSL - (Control IDs: 164.312(a)(2)(iv), 164.312(c)(2), 164.312(e)(1), 164.312(e)(2)(i), 164.312(e)(2)(ii))."
"HIPAA.Security-S3BucketVersioningEnabled","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket does not have versioning enabled - (Control IDs: 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.308(a)(7)(ii)(B), 164.312(c)(1), 164.312(c)(2))."
"HIPAA.Security-S3DefaultEncryptionKMS","CdkNagTestStack/Bucket/Resource","Non-Compliant","N/A","Error","The S3 Bucket is not encrypted with a KMS Key by default - (Control IDs: 164.312(a)(2)(iv), 164.312(e)(2)(ii))."
"HIPAA.Security-S3BucketSSLRequestsOnly","CdkNagTestStack/Bucket/Policy/Resource","Compliant","N/A","Error","The S3 Bucket or bucket policy does not require requests to use SSL - (Control IDs: 164.312(a)(2)(iv), 164.312(c)(2), 164.312(e)(1), 164.312(e)(2)(i), 164.312(e)(2)(ii))."

#!/usr/bin/env node
import "source-map-support/register";
import * as cdk from "aws-cdk-lib";
import { CdkNagTestStack } from "../lib/cdk-nag-test-stack";
import { AwsSolutionsChecks, HIPAASecurityChecks } from "cdk-nag";
import { Aspects } from "aws-cdk-lib";
import "source-map-support/register";

const app = new cdk.App();
Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));
Aspects.of(app).add(new HIPAASecurityChecks({ verbose: true }));
new CdkNagTestStack(app, "CdkNagTestStack", {});