feat(sast): CDK TS policies p3

cdk_integration_tests/src/typescript/EC2PublicIP/fail.ts

@@ -0,0 +1,35 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+
+        const vpc = new ec2.Vpc(this, 'VPC', {
+            cidr: '10.0.0.0/16',
+            natGateways: 0,
+            maxAzs: 2,
+            subnetConfiguration: [
+                {
+                    name: 'public-subnet-1',
+                    subnetType: ec2.SubnetType.PUBLIC,
+                    cidrMask: 24,
+                },
+            ],
+        });
+
+        const instance = new ec2.Instance(this, 'Instance', {
+            vpc,
+            vpcSubnets: {subnetGroupName: 'public-subnet-1'},
+            instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.NANO),
+            machineImage: new ec2.AmazonLinuxImage({generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2}),
+            detailedMonitoring: true,
+            associatePublicIpAddress: true
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/EC2PublicIP/fail_2.ts

@@ -0,0 +1,37 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+
+        const vpc = new ec2.Vpc(this, 'VPC', {
+            cidr: '10.0.0.0/16',
+            natGateways: 0,
+            maxAzs: 2,
+            subnetConfiguration: [
+                {
+                    name: 'public-subnet-1',
+                    subnetType: ec2.SubnetType.PUBLIC,
+                    cidrMask: 24,
+                },
+            ],
+        });
+
+        const sg1 = new ec2.SecurityGroup(this, 'sg1', {
+            vpc: vpc,
+        });
+
+        const launchTemplate = new ec2.LaunchTemplate(this, 'LaunchTemplate', {
+            machineImage: ec2.MachineImage.latestAmazonLinux2023(),
+            securityGroup: sg1,
+            associatePublicIpAddress: true
+        });
+
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/EC2PublicIP/pass.ts

@@ -0,0 +1,35 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+
+        const vpc = new ec2.Vpc(this, 'VPC', {
+            cidr: '10.0.0.0/16',
+            natGateways: 0,
+            maxAzs: 2,
+            subnetConfiguration: [
+                {
+                    name: 'public-subnet-1',
+                    subnetType: ec2.SubnetType.PUBLIC,
+                    cidrMask: 24,
+                },
+            ],
+        });
+
+        const instance = new ec2.Instance(this, 'Instance', {
+            vpc,
+            vpcSubnets: {subnetGroupName: 'public-subnet-1'},
+            instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.NANO),
+            machineImage: new ec2.AmazonLinuxImage({generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2}),
+            detailedMonitoring: true,
+            associatePublicIpAddress: false
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECRImageScanning/fail.ts

@@ -0,0 +1,14 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecr from 'aws-cdk-lib/aws-ecr';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const repository = new ecr.Repository(this, 'Repo', {} );
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECRImageScanning/pass.ts

@@ -0,0 +1,16 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecr from 'aws-cdk-lib/aws-ecr';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const repository = new ecr.Repository(this, 'Repo', {
+            imageScanOnPush: true
+        } );
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECRImmutableTags/fail.ts

@@ -0,0 +1,14 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecr from 'aws-cdk-lib/aws-ecr';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const repository = new ecr.Repository(this, 'Repo', {} );
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECRImmutableTags/pass.ts

@@ -0,0 +1,16 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecr from 'aws-cdk-lib/aws-ecr';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const repository = new ecr.Repository(this, 'Repo', {
+            imageTagMutability: ecr.TagMutability.IMMUTABLE
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECRRepositoryEncrypted/fail.ts

@@ -0,0 +1,14 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecr from 'aws-cdk-lib/aws-ecr';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const repository = new ecr.Repository(this, 'Repo', {} );
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECRRepositoryEncrypted/pass.ts

@@ -0,0 +1,16 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecr from 'aws-cdk-lib/aws-ecr';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const repository = new ecr.Repository(this, 'Repo', {
+            encryption: ecr.RepositoryEncryption.KMS
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECRRepositoryEncrypted/pass_2.ts

@@ -0,0 +1,16 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecr from 'aws-cdk-lib/aws-ecr';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const repository = new ecr.Repository(this, 'Repo', {
+            encryptionKey: new kms.Key(this, 'Key')
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECSClusterContainerInsights/fail.ts

@@ -0,0 +1,16 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const vpc = new ec2.Vpc(this, 'Vpc', {maxAzs: 1});
+        const cluster = new ecs.Cluster(this, 'EcsCluster', {vpc});
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECSClusterContainerInsights/pass.ts

@@ -0,0 +1,16 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const vpc = new ec2.Vpc(this, 'Vpc', {maxAzs: 1});
+        const cluster = new ecs.Cluster(this, 'EcsCluster', {vpc, containerInsights: true});
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECSTaskDefinitionEFSVolumeEncryption/fail.ts

@@ -0,0 +1,24 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef', {
+            volumes:
+            [
+                {
+                    name:"my-volume",
+                    efsVolumeConfiguration:{
+                        transitEncryption: "DISABLED"
+                    }
+                }
+            ]
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECSTaskDefinitionEFSVolumeEncryption/fail_2.ts

@@ -0,0 +1,24 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const taskDefinition = new ecs.FargateTaskDefinition(this, 'TaskDef', {
+            volumes:
+            [
+                {
+                    name:"my-volume",
+                    efsVolumeConfiguration:{
+                        transitEncryption: "DISABLED"
+                    }
+                }
+            ]
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/ECSTaskDefinitionEFSVolumeEncryption/pass.ts

@@ -0,0 +1,24 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef', {
+            volumes:
+            [
+                {
+                    name:"my-volume",
+                    efsVolumeConfiguration:{
+                        transitEncryption: "ENABLED"
+                    }
+                }
+            ]
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/EFSEncryptionEnabled/fail.ts

@@ -0,0 +1,17 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as efs from 'aws-cdk-lib/aws-efs';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
+            vpc: new ec2.Vpc(this, 'VPC')
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/EFSEncryptionEnabled/pass.ts

@@ -0,0 +1,18 @@
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as efs from 'aws-cdk-lib/aws-efs';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
+            vpc: new ec2.Vpc(this, 'VPC'),
+            encrypted: true
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();

cdk_integration_tests/src/typescript/EKSSecretsEncryption/fail.ts

@@ -0,0 +1,21 @@
+import * as cdk from 'aws-cdk-lib';
+import {aws_eks as eks} from 'aws-cdk-lib';
+import {Construct} from 'constructs';
+
+export class exampleStack extends cdk.Stack {
+    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+        super(scope, id, props);
+        const cfnCluster = new eks.CfnCluster(this, 'MyCfnCluster', {
+            resourcesVpcConfig: {
+                subnetIds: ['subnetIds']
+            },
+            roleArn: 'roleArn',
+            name: 'name',
+            version: 'version'
+        });
+    }
+}
+
+const app = new cdk.App();
+new exampleStack(app, 'example-stack');
+app.synth();