Nag error - AwsPrototyping-VPCDefaultSecurityGroupClosed

[drskur]

Node Version

v16.17.0

Deps Version

• "aws-prototyping-sdk": "^0.12.32"
• "aws-cdk-lib": "^2.53.0"
• "cdk-nag": "^2.21.4"
• "constructs": "^10.1.162"

The following error occurred while using the PDK.

[Error at /Dev/ProductSearchStack/Vpc/ProductVpc/Resource] AwsPrototyping-VPCDefaultSecurityGroupClosed: The VPC's default security group allows inbound or outbound traffic.

This error does not occur if AwsPrototypingChecks rule is not used.

const app = PDKNag.app();

It is difficult, because there is no properties to edit default security group, on the Vpc Construct.

Here is my code.

const app = PDKNag.app({
  nagPacks: [new AwsPrototypingChecks()],
});

this.vpc = new Vpc(this, "ProductVpc", {
  vpcName: "product-search",
  subnetConfiguration: [
    {
      cidrMask: 24,
      name: "ingress",
      subnetType: SubnetType.PUBLIC,
      mapPublicIpOnLaunch: false,
    },
    {
      cidrMask: 28,
      name: "rds",
      subnetType: SubnetType.PRIVATE_ISOLATED,
    },
    {
      cidrMask: 28,
      name: "application",
      subnetType: SubnetType.PRIVATE_WITH_EGRESS,
    },
  ],
  flowLogs: {
    cloudwatch: {
      destination: FlowLogDestination.toCloudWatchLogs(cloudWatchLogs),
      trafficType: FlowLogTrafficType.ALL,
    },
  },
});

[dboyd13]

Ack. I'll take a look at this.

[dboyd13]

Please follow the progress of this via issue raised over at cdk-nag

[dboyd13]

Raised #262

[agdimech]

This has been merged.