chore: new tool to run cfn-guard to detect inline broad scoped permissions #34115

QuantumNeuralCoder · 2025-04-11T20:06:47Z

Issue # (if applicable)

None

Closes #.
None

Reason for this change

Adds a new tool to run cfn-guard
Enhances PR linter to find added or updated snapshot templates and run cfn-guard through them for detecting inline broad trust policy

Description of changes

Refer README.md
Also refer the pr-linter change here. This will be opened once current PR is merged.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Tested on personal fork. Refer QuantumNeuralCoder#6
PR Linter output shows test results.

Checklist

[ x] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

codecov · 2025-04-11T20:16:07Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.98%. Comparing base (74cbe27) to head (62b80d8).
Report is 30 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #34115   +/-   ##
=======================================
  Coverage   83.98%   83.98%           
=======================================
  Files         120      120           
  Lines        6976     6976           
  Branches     1178     1178           
=======================================
  Hits         5859     5859           
  Misses       1005     1005           
  Partials      112      112

Flag	Coverage Δ
suite.unit	`83.98% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`83.98% <ø> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Separating github action from the tool

QuantumNeuralCoder · 2025-04-11T22:52:38Z

Exemption Request since github workflow separately tested on personal fork.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

moelasmar · 2025-04-11T23:08:35Z

tools/@aws-cdk/cfn-guard-custom-rules-tool/action.yml

+    required: false
+    default: "single-line-summary"
+
+runs:


since cfn-guard is required, I believe it worth adding a step to install cfn-guard, so we do not need every time we use this GH action to add a step to install it

moelasmar · 2025-04-11T23:09:27Z

tools/@aws-cdk/cfn-guard-custom-rules-tool/action.yml

@@ -0,0 +1,30 @@
+name: 'cfn-guard-custom-rules-tool'
+description: 'CFN Guard for custom or granular guard rules'
+author: QuantumNeuralCoder


should we remove the author :)

moelasmar · 2025-04-11T23:13:41Z

tools/@aws-cdk/cfn-guard-custom-rules-tool/src/index.ts

+    if (!rulePathToUse && ruleSetUrl) {
+      const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'rules-'));
+      rulePathToUse = path.join(tempDir, 'rules.guard');
+      await downloadFile(ruleSetUrl, rulePathToUse);
+    }


I think the rules set file will be always a local file in the repo, why shall we download it ?

Addressed all in latest commit

moelasmar · 2025-04-12T00:23:20Z

.github/workflows/security-guardian.yml

+  # Triggered from a separate job when a review is added
+  workflow_run:
+    workflows: [PR Linter Trigger]
+    types:
+      - completed


this is not required

the PR Linter trigger will trigger this workflow along with PR Linter.

why do we need to link it to PR Linter ?

moelasmar · 2025-04-12T00:24:49Z

.github/workflows/security-guardian.yml

+          echo "pr_number=$(cat pr/pr_number)" >> "$GITHUB_OUTPUT"
+          echo "pr_sha=$(cat pr/pr_sha)" >> "$GITHUB_OUTPUT"
+
+  validate-pr:


why do we need this step ?

shas are referred in the next step. i have renamed the validate-pr step

moelasmar · 2025-04-12T00:46:27Z

.github/workflows/security-guardian.yml

+  download-if-workflow-run:
+    runs-on: ubuntu-latest
+    outputs:
+      pr_number: ${{ steps.pr_output.outputs.pr_number }}
+      pr_sha: ${{ steps.pr_output.outputs.pr_sha }}
+    # if conditions on all individual steps because subsequent jobs depend on this job
+    # and we cannot skip it entirely
+    steps:
+      - name: 'Download workflow_run artifact'
+        if: github.event_name == 'workflow_run'
+        uses: dawidd6/action-download-artifact@v9
+        with:
+          run_id: ${{ github.event.workflow_run.id }}
+          name: pr_info
+          path: pr/
+          search_artifacts: true
+
+      - name: 'Determine PR info'
+        # PR info comes from the artifact if downloaded, or GitHub context if not.
+        if: github.event_name == 'workflow_run'
+        id: 'pr_output'
+        run: |
+          if [[ ! -f pr/pr_number ]]; then
+            echo "${{ github.event.pull_request.number }}" > pr/pr_number
+          fi
+          if [[ ! -f pr/pr_sha ]]; then
+            echo "${{ github.event.pull_request.head.sha }}" > pr/pr_sha
+          fi
+          cat pr/*
+          echo "pr_number=$(cat pr/pr_number)" >> "$GITHUB_OUTPUT"
+          echo "pr_sha=$(cat pr/pr_sha)" >> "$GITHUB_OUTPUT"


what is the value of these steps ?

moelasmar · 2025-04-12T00:47:13Z

.github/workflows/security-guardian.yml

+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: read
+      issues: read
+      checks: read


do not think we need these permissions, we will not update the PR

aws-cdk-automation · 2025-04-12T01:52:12Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 62b80d8
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

feat(cfn-guard-action): Adding cfn guard run to pr linter

d2a8dac

aws-cdk-automation requested a review from a team April 11, 2025 20:06

github-actions bot added the p2 label Apr 11, 2025

QuantumNeuralCoder added pr/do-not-merge This PR should not be merged at this time. and removed p2 labels Apr 11, 2025

mergify bot added the contribution/core This is a PR that came from AWS. label Apr 11, 2025

aws-cdk-automation previously requested changes Apr 11, 2025

View reviewed changes

QuantumNeuralCoder added 5 commits April 11, 2025 14:15

feat(cfn-guard-action): Testing PR files changed testcase

a92e50c

feat(cfn-guard-action): Testing action

e3bbb21

feat(cfn-guard-action): Correcting input validation

cedaa29

feat(cfn-guard-action): test

52656dd

feat(cfn-guard-action): test

9467c57

Separating github action from the tool

QuantumNeuralCoder force-pushed the cfn-guard-action branch from 733b2ef to 9467c57 Compare April 11, 2025 22:38

QuantumNeuralCoder changed the title ~~feat(cfn-guard-action): Adding cfn guard run to pr linter~~ feat(cfn-guard-action): new tool to run cfn-guard to detect inline broad scoped permissions Apr 11, 2025

github-actions bot added the p2 label Apr 11, 2025

adding ReadMe

db2fa71

aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Apr 11, 2025

QuantumNeuralCoder requested a review from moelasmar April 11, 2025 22:53

QuantumNeuralCoder removed the pr/do-not-merge This PR should not be merged at this time. label Apr 11, 2025

QuantumNeuralCoder changed the title ~~feat(cfn-guard-action): new tool to run cfn-guard to detect inline broad scoped permissions~~ chore: new tool to run cfn-guard to detect inline broad scoped permissions Apr 11, 2025

QuantumNeuralCoder mentioned this pull request Apr 11, 2025

chore: cfn-guard action added to pr-linter #34118

Closed

moelasmar reviewed Apr 11, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Apr 11, 2025

QuantumNeuralCoder added 2 commits April 11, 2025 17:11

adding security guardian tool

9ab2a88

adding security guardian tool

2c1516e

adding security guardian tool

c4d7711

moelasmar reviewed Apr 12, 2025

View reviewed changes

adding security guardian tool

d1f9fdd

moelasmar reviewed Apr 12, 2025

View reviewed changes

moelasmar added 4 commits April 11, 2025 18:10

Update security-guardian.yml

01be751

temp Update security-guardian.yml

687452c

Update security-guardian.yml

923bdd0

testing security-guardian.yml

62b80d8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: new tool to run cfn-guard to detect inline broad scoped permissions #34115

chore: new tool to run cfn-guard to detect inline broad scoped permissions #34115

QuantumNeuralCoder commented Apr 11, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Apr 11, 2025 •

edited

Loading

QuantumNeuralCoder commented Apr 11, 2025

moelasmar Apr 11, 2025

moelasmar Apr 11, 2025

moelasmar Apr 11, 2025

QuantumNeuralCoder Apr 12, 2025

moelasmar Apr 12, 2025

QuantumNeuralCoder Apr 12, 2025

moelasmar Apr 12, 2025

moelasmar Apr 12, 2025

QuantumNeuralCoder Apr 12, 2025

moelasmar Apr 12, 2025

moelasmar Apr 12, 2025

aws-cdk-automation commented Apr 12, 2025

chore: new tool to run cfn-guard to detect inline broad scoped permissions #34115

Are you sure you want to change the base?

chore: new tool to run cfn-guard to detect inline broad scoped permissions #34115

Conversation

QuantumNeuralCoder commented Apr 11, 2025 • edited Loading

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

codecov bot commented Apr 11, 2025 • edited Loading

Codecov Report

QuantumNeuralCoder commented Apr 11, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aws-cdk-automation commented Apr 12, 2025

AWS CodeBuild CI Report

QuantumNeuralCoder commented Apr 11, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Apr 11, 2025 •

edited

Loading