diff --git a/API.md b/API.md index 2204027dc2..6a09194f79 100644 --- a/API.md +++ b/API.md @@ -1,1575 +1,2718 @@ -# API Reference - -**Classes** - -Name|Description -----|----------- -[AnnotationLogger](#cdk-nag-annotationlogger)|A NagLogger that outputs to the CDK Annotations system. -[AwsSolutionsChecks](#cdk-nag-awssolutionschecks)|Check Best practices based on AWS Solutions Security Matrix. -[HIPAASecurityChecks](#cdk-nag-hipaasecuritychecks)|Check for HIPAA Security compliance. -[NIST80053R4Checks](#cdk-nag-nist80053r4checks)|Check for NIST 800-53 rev 4 compliance. -[NIST80053R5Checks](#cdk-nag-nist80053r5checks)|Check for NIST 800-53 rev 5 compliance. -[NagPack](#cdk-nag-nagpack)|Base class for all rule packs. -[NagReportLogger](#cdk-nag-nagreportlogger)|A NagLogger that creates compliance reports. -[NagRules](#cdk-nag-nagrules)|Helper class with methods for rule creation. -[NagSuppressions](#cdk-nag-nagsuppressions)|Helper class with methods to add cdk-nag suppressions to cdk resources. -[PCIDSS321Checks](#cdk-nag-pcidss321checks)|Check for PCI DSS 3.2.1 compliance. Based on the PCI DSS 3.2.1 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-pci-dss.html. -[SuppressionIgnoreAlways](#cdk-nag-suppressionignorealways)|Always ignore the suppression. -[SuppressionIgnoreAnd](#cdk-nag-suppressionignoreand)|Ignore the suppression if all of the given INagSuppressionIgnore return a non-empty message. -[SuppressionIgnoreErrors](#cdk-nag-suppressionignoreerrors)|Ignore Suppressions for Rules with a NagMessageLevel.ERROR. -[SuppressionIgnoreNever](#cdk-nag-suppressionignorenever)|Don't ignore the suppression. -[SuppressionIgnoreOr](#cdk-nag-suppressionignoreor)|Ignore the suppression if any of the given INagSuppressionIgnore return a non-empty message. - - -**Structs** - -Name|Description -----|----------- -[AnnotationLoggerProps](#cdk-nag-annotationloggerprops)|Props for the AnnotationLogger. -[NagLoggerBaseData](#cdk-nag-nagloggerbasedata)|Shared data for all INagLogger methods. -[NagLoggerComplianceData](#cdk-nag-nagloggercompliancedata)|Data for onCompliance method of an INagLogger. -[NagLoggerErrorData](#cdk-nag-nagloggererrordata)|Data for onError method of an INagLogger. -[NagLoggerNonComplianceData](#cdk-nag-nagloggernoncompliancedata)|Data for onNonCompliance method of an INagLogger. -[NagLoggerNotApplicableData](#cdk-nag-nagloggernotapplicabledata)|Data for onNotApplicable method of an INagLogger. -[NagLoggerSuppressedData](#cdk-nag-nagloggersuppresseddata)|Data for onSuppressed method of an INagLogger. -[NagLoggerSuppressedErrorData](#cdk-nag-nagloggersuppressederrordata)|Data for onSuppressedError method of an INagLogger. -[NagPackProps](#cdk-nag-nagpackprops)|Interface for creating a NagPack. -[NagPackSuppression](#cdk-nag-nagpacksuppression)|Interface for creating a rule suppression. -[NagReportLine](#cdk-nag-nagreportline)|*No description* -[NagReportLoggerProps](#cdk-nag-nagreportloggerprops)|Props for the NagReportLogger. -[NagReportSchema](#cdk-nag-nagreportschema)|*No description* -[RegexAppliesTo](#cdk-nag-regexappliesto)|A regular expression to apply to matching findings. -[SuppressionIgnoreInput](#cdk-nag-suppressionignoreinput)|Information about the NagRule and the relevant NagSuppression for the INagSuppressionIgnore. - - -**Interfaces** - -Name|Description -----|----------- -[IApplyRule](#cdk-nag-iapplyrule)|Interface for JSII interoperability for passing parameters and the Rule Callback to @applyRule method. -[INagLogger](#cdk-nag-inaglogger)|Interface for creating NagSuppression Ignores. -[INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)|Interface for creating NagSuppression Ignores. - - -**Enums** - -Name|Description -----|----------- -[NagMessageLevel](#cdk-nag-nagmessagelevel)|The severity level of the rule. -[NagReportFormat](#cdk-nag-nagreportformat)|Possible output formats of the NagReport. -[NagRuleCompliance](#cdk-nag-nagrulecompliance)|The compliance level of a resource in relation to a rule. -[NagRulePostValidationStates](#cdk-nag-nagrulepostvalidationstates)|Additional states a rule can be in post compliance validation. - - - -## class AnnotationLogger +# API Reference -A NagLogger that outputs to the CDK Annotations system. -__Implements__: [INagLogger](#cdk-nag-inaglogger) +## Structs -### Initializer +### AnnotationLoggerProps +Props for the AnnotationLogger. +#### Initializer +```typescript +import { AnnotationLoggerProps } from 'cdk-nag' -```ts -new AnnotationLogger(props?: AnnotationLoggerProps) +const annotationLoggerProps: AnnotationLoggerProps = { ... } ``` -* **props** ([AnnotationLoggerProps](#cdk-nag-annotationloggerprops)) *No description* - * **logIgnores** (boolean) Whether or not to log suppressed rule violations as informational messages (default: false). __*Optional*__ - * **verbose** (boolean) Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages. __*Optional*__ - +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| logIgnores | boolean | Whether or not to log suppressed rule violations as informational messages (default: false). | +| verbose | boolean | Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages. | -### Properties +--- +##### `logIgnores`Optional -Name | Type | Description ------|------|------------- -**logIgnores** | boolean | -**suppressionId** | string | -**verbose** | boolean | +```typescript +public readonly logIgnores: boolean; +``` -### Methods +- *Type:* boolean +Whether or not to log suppressed rule violations as informational messages (default: false). -#### onCompliance(_data) +--- -Called when a CfnResource passes the compliance check for a given rule. +##### `verbose`Optional -```ts -onCompliance(_data: NagLoggerComplianceData): void +```typescript +public readonly verbose: boolean; ``` -* **_data** ([NagLoggerComplianceData](#cdk-nag-nagloggercompliancedata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* +- *Type:* boolean +Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages. +--- +### NagLoggerBaseData -#### onError(data) - -Called when a rule throws an error during while validating a CfnResource for compliance. +Shared data for all INagLogger methods. -```ts -onError(data: NagLoggerErrorData): void -``` +#### Initializer -* **data** ([NagLoggerErrorData](#cdk-nag-nagloggererrordata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **errorMessage** (string) *No description* +```typescript +import { NagLoggerBaseData } from 'cdk-nag' +const nagLoggerBaseData: NagLoggerBaseData = { ... } +``` +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| nagPackName | string | *No description.* | +| resource | aws-cdk-lib.CfnResource | *No description.* | +| ruleExplanation | string | *No description.* | +| ruleId | string | *No description.* | +| ruleInfo | string | *No description.* | +| ruleLevel | NagMessageLevel | *No description.* | +| ruleOriginalName | string | *No description.* | -#### onNonCompliance(data) +--- -Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. +##### `nagPackName`Required -```ts -onNonCompliance(data: NagLoggerNonComplianceData): void +```typescript +public readonly nagPackName: string; ``` -* **data** ([NagLoggerNonComplianceData](#cdk-nag-nagloggernoncompliancedata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **findingId** (string) *No description* +- *Type:* string +--- +##### `resource`Required +```typescript +public readonly resource: CfnResource; +``` -#### onNotApplicable(_data) +- *Type:* aws-cdk-lib.CfnResource -Called when a rule does not apply to the given CfnResource. +--- -```ts -onNotApplicable(_data: NagLoggerNotApplicableData): void +##### `ruleExplanation`Required + +```typescript +public readonly ruleExplanation: string; ``` -* **_data** ([NagLoggerNotApplicableData](#cdk-nag-nagloggernotapplicabledata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* +- *Type:* string + +--- +##### `ruleId`Required +```typescript +public readonly ruleId: string; +``` +- *Type:* string -#### onSuppressed(data) +--- -Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. +##### `ruleInfo`Required -```ts -onSuppressed(data: NagLoggerSuppressedData): void +```typescript +public readonly ruleInfo: string; ``` -* **data** ([NagLoggerSuppressedData](#cdk-nag-nagloggersuppresseddata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **findingId** (string) *No description* - * **suppressionReason** (string) *No description* +- *Type:* string +--- +##### `ruleLevel`Required +```typescript +public readonly ruleLevel: NagMessageLevel; +``` -#### onSuppressedError(data) +- *Type:* NagMessageLevel -Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. +--- -```ts -onSuppressedError(data: NagLoggerSuppressedErrorData): void -``` +##### `ruleOriginalName`Required -* **data** ([NagLoggerSuppressedErrorData](#cdk-nag-nagloggersuppressederrordata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **errorMessage** (string) *No description* - * **errorSuppressionReason** (string) *No description* +```typescript +public readonly ruleOriginalName: string; +``` +- *Type:* string +--- +### NagLoggerComplianceData -#### protected createMessage(ruleId, findingId, ruleInfo, ruleExplanation, verbose) +Data for onCompliance method of an INagLogger. +#### Initializer +```typescript +import { NagLoggerComplianceData } from 'cdk-nag' -```ts -protected createMessage(ruleId: string, findingId: string, ruleInfo: string, ruleExplanation: string, verbose: boolean): string +const nagLoggerComplianceData: NagLoggerComplianceData = { ... } ``` -* **ruleId** (string) *No description* -* **findingId** (string) *No description* -* **ruleInfo** (string) *No description* -* **ruleExplanation** (string) *No description* -* **verbose** (boolean) *No description* +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| nagPackName | string | *No description.* | +| resource | aws-cdk-lib.CfnResource | *No description.* | +| ruleExplanation | string | *No description.* | +| ruleId | string | *No description.* | +| ruleInfo | string | *No description.* | +| ruleLevel | NagMessageLevel | *No description.* | +| ruleOriginalName | string | *No description.* | -__Returns__: -* string +--- +##### `nagPackName`Required +```typescript +public readonly nagPackName: string; +``` -## class AwsSolutionsChecks +- *Type:* string -Check Best practices based on AWS Solutions Security Matrix. +--- -__Implements__: [IAspect](#aws-cdk-lib-iaspect) -__Extends__: [NagPack](#cdk-nag-nagpack) +##### `resource`Required -### Initializer +```typescript +public readonly resource: CfnResource; +``` +- *Type:* aws-cdk-lib.CfnResource +--- +##### `ruleExplanation`Required -```ts -new AwsSolutionsChecks(props?: NagPackProps) +```typescript +public readonly ruleExplanation: string; ``` -* **props** ([NagPackProps](#cdk-nag-nagpackprops)) *No description* - * **additionalLoggers** (Array<[INagLogger](#cdk-nag-inaglogger)>) Additional NagLoggers for logging rule validation outputs. __*Optional*__ - * **logIgnores** (boolean) Whether or not to log suppressed rule violations as informational messages (default: false). __*Optional*__ - * **reportFormats** (Array<[NagReportFormat](#cdk-nag-nagreportformat)>) If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). __*Optional*__ - * **reports** (boolean) Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). __*Optional*__ - * **suppressionIgnoreCondition** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) Conditionally prevent rules from being suppressed (default: no user provided condition). __*Optional*__ - * **verbose** (boolean) Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). __*Optional*__ +- *Type:* string +--- -### Methods +##### `ruleId`Required +```typescript +public readonly ruleId: string; +``` -#### visit(node) +- *Type:* string -All aspects can visit an IConstruct. +--- -```ts -visit(node: IConstruct): void +##### `ruleInfo`Required + +```typescript +public readonly ruleInfo: string; ``` -* **node** ([IConstruct](#constructs-iconstruct)) *No description* +- *Type:* string +--- +##### `ruleLevel`Required +```typescript +public readonly ruleLevel: NagMessageLevel; +``` +- *Type:* NagMessageLevel +--- -## class HIPAASecurityChecks +##### `ruleOriginalName`Required -Check for HIPAA Security compliance. +```typescript +public readonly ruleOriginalName: string; +``` -Based on the HIPAA Security AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-hipaa_security.html +- *Type:* string -__Implements__: [IAspect](#aws-cdk-lib-iaspect) -__Extends__: [NagPack](#cdk-nag-nagpack) +--- -### Initializer +### NagLoggerErrorData +Data for onError method of an INagLogger. +#### Initializer +```typescript +import { NagLoggerErrorData } from 'cdk-nag' -```ts -new HIPAASecurityChecks(props?: NagPackProps) +const nagLoggerErrorData: NagLoggerErrorData = { ... } ``` -* **props** ([NagPackProps](#cdk-nag-nagpackprops)) *No description* - * **additionalLoggers** (Array<[INagLogger](#cdk-nag-inaglogger)>) Additional NagLoggers for logging rule validation outputs. __*Optional*__ - * **logIgnores** (boolean) Whether or not to log suppressed rule violations as informational messages (default: false). __*Optional*__ - * **reportFormats** (Array<[NagReportFormat](#cdk-nag-nagreportformat)>) If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). __*Optional*__ - * **reports** (boolean) Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). __*Optional*__ - * **suppressionIgnoreCondition** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) Conditionally prevent rules from being suppressed (default: no user provided condition). __*Optional*__ - * **verbose** (boolean) Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). __*Optional*__ - +#### Properties -### Methods +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| nagPackName | string | *No description.* | +| resource | aws-cdk-lib.CfnResource | *No description.* | +| ruleExplanation | string | *No description.* | +| ruleId | string | *No description.* | +| ruleInfo | string | *No description.* | +| ruleLevel | NagMessageLevel | *No description.* | +| ruleOriginalName | string | *No description.* | +| errorMessage | string | *No description.* | +--- -#### visit(node) - -All aspects can visit an IConstruct. +##### `nagPackName`Required -```ts -visit(node: IConstruct): void +```typescript +public readonly nagPackName: string; ``` -* **node** ([IConstruct](#constructs-iconstruct)) *No description* +- *Type:* string +--- +##### `resource`Required +```typescript +public readonly resource: CfnResource; +``` +- *Type:* aws-cdk-lib.CfnResource +--- -## class NIST80053R4Checks +##### `ruleExplanation`Required -Check for NIST 800-53 rev 4 compliance. +```typescript +public readonly ruleExplanation: string; +``` -Based on the NIST 800-53 rev 4 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_4.html +- *Type:* string -__Implements__: [IAspect](#aws-cdk-lib-iaspect) -__Extends__: [NagPack](#cdk-nag-nagpack) +--- -### Initializer +##### `ruleId`Required +```typescript +public readonly ruleId: string; +``` +- *Type:* string +--- -```ts -new NIST80053R4Checks(props?: NagPackProps) +##### `ruleInfo`Required + +```typescript +public readonly ruleInfo: string; ``` -* **props** ([NagPackProps](#cdk-nag-nagpackprops)) *No description* - * **additionalLoggers** (Array<[INagLogger](#cdk-nag-inaglogger)>) Additional NagLoggers for logging rule validation outputs. __*Optional*__ - * **logIgnores** (boolean) Whether or not to log suppressed rule violations as informational messages (default: false). __*Optional*__ - * **reportFormats** (Array<[NagReportFormat](#cdk-nag-nagreportformat)>) If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). __*Optional*__ - * **reports** (boolean) Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). __*Optional*__ - * **suppressionIgnoreCondition** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) Conditionally prevent rules from being suppressed (default: no user provided condition). __*Optional*__ - * **verbose** (boolean) Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). __*Optional*__ +- *Type:* string + +--- +##### `ruleLevel`Required -### Methods +```typescript +public readonly ruleLevel: NagMessageLevel; +``` +- *Type:* NagMessageLevel -#### visit(node) +--- -All aspects can visit an IConstruct. +##### `ruleOriginalName`Required -```ts -visit(node: IConstruct): void +```typescript +public readonly ruleOriginalName: string; ``` -* **node** ([IConstruct](#constructs-iconstruct)) *No description* +- *Type:* string +--- +##### `errorMessage`Required +```typescript +public readonly errorMessage: string; +``` +- *Type:* string +--- -## class NIST80053R5Checks +### NagLoggerNonComplianceData -Check for NIST 800-53 rev 5 compliance. +Data for onNonCompliance method of an INagLogger. -Based on the NIST 800-53 rev 5 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_5.html +#### Initializer -__Implements__: [IAspect](#aws-cdk-lib-iaspect) -__Extends__: [NagPack](#cdk-nag-nagpack) +```typescript +import { NagLoggerNonComplianceData } from 'cdk-nag' -### Initializer +const nagLoggerNonComplianceData: NagLoggerNonComplianceData = { ... } +``` +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| nagPackName | string | *No description.* | +| resource | aws-cdk-lib.CfnResource | *No description.* | +| ruleExplanation | string | *No description.* | +| ruleId | string | *No description.* | +| ruleInfo | string | *No description.* | +| ruleLevel | NagMessageLevel | *No description.* | +| ruleOriginalName | string | *No description.* | +| findingId | string | *No description.* | +--- -```ts -new NIST80053R5Checks(props?: NagPackProps) +##### `nagPackName`Required + +```typescript +public readonly nagPackName: string; ``` -* **props** ([NagPackProps](#cdk-nag-nagpackprops)) *No description* - * **additionalLoggers** (Array<[INagLogger](#cdk-nag-inaglogger)>) Additional NagLoggers for logging rule validation outputs. __*Optional*__ - * **logIgnores** (boolean) Whether or not to log suppressed rule violations as informational messages (default: false). __*Optional*__ - * **reportFormats** (Array<[NagReportFormat](#cdk-nag-nagreportformat)>) If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). __*Optional*__ - * **reports** (boolean) Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). __*Optional*__ - * **suppressionIgnoreCondition** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) Conditionally prevent rules from being suppressed (default: no user provided condition). __*Optional*__ - * **verbose** (boolean) Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). __*Optional*__ +- *Type:* string + +--- +##### `resource`Required -### Methods +```typescript +public readonly resource: CfnResource; +``` +- *Type:* aws-cdk-lib.CfnResource -#### visit(node) +--- -All aspects can visit an IConstruct. +##### `ruleExplanation`Required -```ts -visit(node: IConstruct): void +```typescript +public readonly ruleExplanation: string; ``` -* **node** ([IConstruct](#constructs-iconstruct)) *No description* +- *Type:* string +--- +##### `ruleId`Required +```typescript +public readonly ruleId: string; +``` +- *Type:* string +--- -## class NagPack +##### `ruleInfo`Required -Base class for all rule packs. +```typescript +public readonly ruleInfo: string; +``` + +- *Type:* string -__Implements__: [IAspect](#aws-cdk-lib-iaspect) -__Implemented by__: [AwsSolutionsChecks](#cdk-nag-awssolutionschecks), [HIPAASecurityChecks](#cdk-nag-hipaasecuritychecks), [NIST80053R4Checks](#cdk-nag-nist80053r4checks), [NIST80053R5Checks](#cdk-nag-nist80053r5checks), [PCIDSS321Checks](#cdk-nag-pcidss321checks) +--- -### Initializer +##### `ruleLevel`Required +```typescript +public readonly ruleLevel: NagMessageLevel; +``` +- *Type:* NagMessageLevel +--- -```ts -new NagPack(props?: NagPackProps) +##### `ruleOriginalName`Required + +```typescript +public readonly ruleOriginalName: string; ``` -* **props** ([NagPackProps](#cdk-nag-nagpackprops)) *No description* - * **additionalLoggers** (Array<[INagLogger](#cdk-nag-inaglogger)>) Additional NagLoggers for logging rule validation outputs. __*Optional*__ - * **logIgnores** (boolean) Whether or not to log suppressed rule violations as informational messages (default: false). __*Optional*__ - * **reportFormats** (Array<[NagReportFormat](#cdk-nag-nagreportformat)>) If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). __*Optional*__ - * **reports** (boolean) Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). __*Optional*__ - * **suppressionIgnoreCondition** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) Conditionally prevent rules from being suppressed (default: no user provided condition). __*Optional*__ - * **verbose** (boolean) Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). __*Optional*__ +- *Type:* string +--- +##### `findingId`Required -### Properties +```typescript +public readonly findingId: string; +``` +- *Type:* string -Name | Type | Description ------|------|------------- -**loggers** | Array<[INagLogger](#cdk-nag-inaglogger)> | -**packName** | string | -**readPackName** | string | -**packGlobalSuppressionIgnore**? | [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) | __*Optional*__ -**userGlobalSuppressionIgnore**? | [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) | __*Optional*__ +--- -### Methods +### NagLoggerNotApplicableData +Data for onNotApplicable method of an INagLogger. -#### visit(node) +#### Initializer -All aspects can visit an IConstruct. +```typescript +import { NagLoggerNotApplicableData } from 'cdk-nag' -```ts -visit(node: IConstruct): void +const nagLoggerNotApplicableData: NagLoggerNotApplicableData = { ... } ``` -* **node** ([IConstruct](#constructs-iconstruct)) *No description* - - +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| nagPackName | string | *No description.* | +| resource | aws-cdk-lib.CfnResource | *No description.* | +| ruleExplanation | string | *No description.* | +| ruleId | string | *No description.* | +| ruleInfo | string | *No description.* | +| ruleLevel | NagMessageLevel | *No description.* | +| ruleOriginalName | string | *No description.* | -#### protected applyRule(params) +--- -Create a rule to be used in the NagPack. +##### `nagPackName`Required -```ts -protected applyRule(params: IApplyRule): void +```typescript +public readonly nagPackName: string; ``` -* **params** ([IApplyRule](#cdk-nag-iapplyrule)) The. +- *Type:* string +--- +##### `resource`Required +```typescript +public readonly resource: CfnResource; +``` + +- *Type:* aws-cdk-lib.CfnResource -#### protected ignoreRule(suppressions, ruleId, findingId, resource, level, ignoreSuppressionCondition?) +--- -Check whether a specific rule should be ignored. +##### `ruleExplanation`Required -```ts -protected ignoreRule(suppressions: Array, ruleId: string, findingId: string, resource: CfnResource, level: NagMessageLevel, ignoreSuppressionCondition?: INagSuppressionIgnore): string +```typescript +public readonly ruleExplanation: string; ``` -* **suppressions** (Array<[NagPackSuppression](#cdk-nag-nagpacksuppression)>) The suppressions listed in the cdk-nag metadata. -* **ruleId** (string) The id of the rule to ignore. -* **findingId** (string) The id of the finding that is being checked. -* **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) The resource being evaluated. -* **level** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* -* **ignoreSuppressionCondition** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) *No description* +- *Type:* string -__Returns__: -* string +--- +##### `ruleId`Required +```typescript +public readonly ruleId: string; +``` -## class NagReportLogger +- *Type:* string -A NagLogger that creates compliance reports. +--- -__Implements__: [INagLogger](#cdk-nag-inaglogger) +##### `ruleInfo`Required -### Initializer +```typescript +public readonly ruleInfo: string; +``` +- *Type:* string +--- +##### `ruleLevel`Required -```ts -new NagReportLogger(props: NagReportLoggerProps) +```typescript +public readonly ruleLevel: NagMessageLevel; ``` -* **props** ([NagReportLoggerProps](#cdk-nag-nagreportloggerprops)) *No description* - * **formats** (Array<[NagReportFormat](#cdk-nag-nagreportformat)>) *No description* +- *Type:* NagMessageLevel +--- +##### `ruleOriginalName`Required -### Properties - +```typescript +public readonly ruleOriginalName: string; +``` -Name | Type | Description ------|------|------------- -**formats** | Array<[NagReportFormat](#cdk-nag-nagreportformat)> | +- *Type:* string -### Methods +--- +### NagLoggerSuppressedData -#### getFormatStacks(format) +Data for onSuppressed method of an INagLogger. +#### Initializer +```typescript +import { NagLoggerSuppressedData } from 'cdk-nag' -```ts -getFormatStacks(format: NagReportFormat): Array +const nagLoggerSuppressedData: NagLoggerSuppressedData = { ... } ``` -* **format** ([NagReportFormat](#cdk-nag-nagreportformat)) *No description* +#### Properties -__Returns__: -* Array +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| nagPackName | string | *No description.* | +| resource | aws-cdk-lib.CfnResource | *No description.* | +| ruleExplanation | string | *No description.* | +| ruleId | string | *No description.* | +| ruleInfo | string | *No description.* | +| ruleLevel | NagMessageLevel | *No description.* | +| ruleOriginalName | string | *No description.* | +| findingId | string | *No description.* | +| suppressionReason | string | *No description.* | -#### onCompliance(data) +--- -Called when a CfnResource passes the compliance check for a given rule. +##### `nagPackName`Required -```ts -onCompliance(data: NagLoggerComplianceData): void +```typescript +public readonly nagPackName: string; ``` -* **data** ([NagLoggerComplianceData](#cdk-nag-nagloggercompliancedata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* +- *Type:* string +--- +##### `resource`Required +```typescript +public readonly resource: CfnResource; +``` -#### onError(data) +- *Type:* aws-cdk-lib.CfnResource -Called when a rule throws an error during while validating a CfnResource for compliance. +--- -```ts -onError(data: NagLoggerErrorData): void +##### `ruleExplanation`Required + +```typescript +public readonly ruleExplanation: string; ``` -* **data** ([NagLoggerErrorData](#cdk-nag-nagloggererrordata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **errorMessage** (string) *No description* +- *Type:* string + +--- +##### `ruleId`Required +```typescript +public readonly ruleId: string; +``` +- *Type:* string -#### onNonCompliance(data) +--- -Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. +##### `ruleInfo`Required -```ts -onNonCompliance(data: NagLoggerNonComplianceData): void +```typescript +public readonly ruleInfo: string; ``` -* **data** ([NagLoggerNonComplianceData](#cdk-nag-nagloggernoncompliancedata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **findingId** (string) *No description* +- *Type:* string +--- +##### `ruleLevel`Required +```typescript +public readonly ruleLevel: NagMessageLevel; +``` -#### onNotApplicable(data) +- *Type:* NagMessageLevel -Called when a rule does not apply to the given CfnResource. +--- -```ts -onNotApplicable(data: NagLoggerNotApplicableData): void +##### `ruleOriginalName`Required + +```typescript +public readonly ruleOriginalName: string; ``` -* **data** ([NagLoggerNotApplicableData](#cdk-nag-nagloggernotapplicabledata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* +- *Type:* string + +--- +##### `findingId`Required +```typescript +public readonly findingId: string; +``` +- *Type:* string -#### onSuppressed(data) +--- -Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. +##### `suppressionReason`Required -```ts -onSuppressed(data: NagLoggerSuppressedData): void +```typescript +public readonly suppressionReason: string; ``` -* **data** ([NagLoggerSuppressedData](#cdk-nag-nagloggersuppresseddata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **findingId** (string) *No description* - * **suppressionReason** (string) *No description* +- *Type:* string +--- +### NagLoggerSuppressedErrorData +Data for onSuppressedError method of an INagLogger. -#### onSuppressedError(data) +#### Initializer -Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. +```typescript +import { NagLoggerSuppressedErrorData } from 'cdk-nag' -```ts -onSuppressedError(data: NagLoggerSuppressedErrorData): void +const nagLoggerSuppressedErrorData: NagLoggerSuppressedErrorData = { ... } ``` -* **data** ([NagLoggerSuppressedErrorData](#cdk-nag-nagloggersuppressederrordata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **errorMessage** (string) *No description* - * **errorSuppressionReason** (string) *No description* +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| nagPackName | string | *No description.* | +| resource | aws-cdk-lib.CfnResource | *No description.* | +| ruleExplanation | string | *No description.* | +| ruleId | string | *No description.* | +| ruleInfo | string | *No description.* | +| ruleLevel | NagMessageLevel | *No description.* | +| ruleOriginalName | string | *No description.* | +| errorMessage | string | *No description.* | +| errorSuppressionReason | string | *No description.* | +--- +##### `nagPackName`Required -#### protected initializeStackReport(data) - -Initialize the report for the rule pack's compliance report for the resource's Stack if it doesn't exist. - -```ts -protected initializeStackReport(data: NagLoggerBaseData): void +```typescript +public readonly nagPackName: string; ``` -* **data** ([NagLoggerBaseData](#cdk-nag-nagloggerbasedata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* +- *Type:* string +--- +##### `resource`Required +```typescript +public readonly resource: CfnResource; +``` -#### protected writeToStackComplianceReport(data, compliance) +- *Type:* aws-cdk-lib.CfnResource +--- +##### `ruleExplanation`Required -```ts -protected writeToStackComplianceReport(data: NagLoggerBaseData, compliance: NagRuleCompliance | NagRulePostValidationStates): void +```typescript +public readonly ruleExplanation: string; ``` -* **data** ([NagLoggerBaseData](#cdk-nag-nagloggerbasedata)) *No description* -* **compliance** ([NagRuleCompliance](#cdk-nag-nagrulecompliance) | [NagRulePostValidationStates](#cdk-nag-nagrulepostvalidationstates)) *No description* +- *Type:* string +--- +##### `ruleId`Required +```typescript +public readonly ruleId: string; +``` +- *Type:* string +--- -## class NagRules +##### `ruleInfo`Required -Helper class with methods for rule creation. +```typescript +public readonly ruleInfo: string; +``` +- *Type:* string -### Initializer +--- +##### `ruleLevel`Required +```typescript +public readonly ruleLevel: NagMessageLevel; +``` +- *Type:* NagMessageLevel -```ts -new NagRules() +--- + +##### `ruleOriginalName`Required + +```typescript +public readonly ruleOriginalName: string; ``` +- *Type:* string +--- -### Methods +##### `errorMessage`Required +```typescript +public readonly errorMessage: string; +``` -#### *static* resolveIfPrimitive(node, parameter) +- *Type:* string -Use in cases where a primitive value must be known to pass a rule. +--- -https://developer.mozilla.org/en-US/docs/Glossary/Primitive +##### `errorSuppressionReason`Required -```ts -static resolveIfPrimitive(node: CfnResource, parameter: any): any +```typescript +public readonly errorSuppressionReason: string; ``` -* **node** ([CfnResource](#aws-cdk-lib-cfnresource)) The CfnResource to check. -* **parameter** (any) The value to attempt to resolve. +- *Type:* string -__Returns__: -* any +--- -#### *static* resolveResourceFromInstrinsic(node, parameter) +### NagPackProps -Use in cases where a token resolves to an intrinsic function and the referenced resource must be known to pass a rule. +Interface for creating a NagPack. -```ts -static resolveResourceFromInstrinsic(node: CfnResource, parameter: any): any -``` +#### Initializer -* **node** ([CfnResource](#aws-cdk-lib-cfnresource)) The CfnResource to check. -* **parameter** (any) The value to attempt to resolve. +```typescript +import { NagPackProps } from 'cdk-nag' -__Returns__: -* any +const nagPackProps: NagPackProps = { ... } +``` +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| additionalLoggers | INagLogger[] | Additional NagLoggers for logging rule validation outputs. | +| logIgnores | boolean | Whether or not to log suppressed rule violations as informational messages (default: false). | +| reportFormats | NagReportFormat[] | If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). | +| reports | boolean | Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). | +| suppressionIgnoreCondition | INagSuppressionIgnore | Conditionally prevent rules from being suppressed (default: no user provided condition). | +| verbose | boolean | Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). | -## class NagSuppressions +--- -Helper class with methods to add cdk-nag suppressions to cdk resources. +##### `additionalLoggers`Optional +```typescript +public readonly additionalLoggers: INagLogger[]; +``` -### Initializer +- *Type:* INagLogger[] +Additional NagLoggers for logging rule validation outputs. +--- +##### `logIgnores`Optional -```ts -new NagSuppressions() +```typescript +public readonly logIgnores: boolean; ``` +- *Type:* boolean +Whether or not to log suppressed rule violations as informational messages (default: false). -### Methods +--- +##### `reportFormats`Optional -#### *static* addResourceSuppressions(construct, suppressions, applyToChildren?) +```typescript +public readonly reportFormats: NagReportFormat[]; +``` -Add cdk-nag suppressions to a CfnResource and optionally its children. +- *Type:* NagReportFormat[] + +If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). + +--- -```ts -static addResourceSuppressions(construct: IConstruct | Array, suppressions: Array, applyToChildren?: boolean): void +##### `reports`Optional + +```typescript +public readonly reports: boolean; ``` -* **construct** ([IConstruct](#constructs-iconstruct) | Array<[IConstruct](#constructs-iconstruct)>) The IConstruct(s) to apply the suppression to. -* **suppressions** (Array<[NagPackSuppression](#cdk-nag-nagpacksuppression)>) A list of suppressions to apply to the resource. -* **applyToChildren** (boolean) Apply the suppressions to children CfnResources (default:false). +- *Type:* boolean + +Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). +--- +##### `suppressionIgnoreCondition`Optional +```typescript +public readonly suppressionIgnoreCondition: INagSuppressionIgnore; +``` -#### *static* addResourceSuppressionsByPath(stack, path, suppressions, applyToChildren?) +- *Type:* INagSuppressionIgnore -Add cdk-nag suppressions to a CfnResource and optionally its children via its path. +Conditionally prevent rules from being suppressed (default: no user provided condition). -```ts -static addResourceSuppressionsByPath(stack: Stack, path: string | Array, suppressions: Array, applyToChildren?: boolean): void +--- + +##### `verbose`Optional + +```typescript +public readonly verbose: boolean; ``` -* **stack** ([Stack](#aws-cdk-lib-stack)) The Stack the construct belongs to. -* **path** (string | Array) The path(s) to the construct in the provided stack. -* **suppressions** (Array<[NagPackSuppression](#cdk-nag-nagpacksuppression)>) A list of suppressions to apply to the resource. -* **applyToChildren** (boolean) Apply the suppressions to children CfnResources (default:false). +- *Type:* boolean +Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). +--- +### NagPackSuppression -#### *static* addStackSuppressions(stack, suppressions, applyToNestedStacks?) +Interface for creating a rule suppression. -Apply cdk-nag suppressions to a Stack and optionally nested stacks. +#### Initializer -```ts -static addStackSuppressions(stack: Stack, suppressions: Array, applyToNestedStacks?: boolean): void +```typescript +import { NagPackSuppression } from 'cdk-nag' + +const nagPackSuppression: NagPackSuppression = { ... } ``` -* **stack** ([Stack](#aws-cdk-lib-stack)) The Stack to apply the suppression to. -* **suppressions** (Array<[NagPackSuppression](#cdk-nag-nagpacksuppression)>) A list of suppressions to apply to the stack. -* **applyToNestedStacks** (boolean) Apply the suppressions to children stacks (default:false). +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| id | string | The id of the rule to ignore. | +| reason | string | The reason to ignore the rule (minimum 10 characters). | +| appliesTo | string \| RegexAppliesTo[] | Rule specific granular suppressions. | +--- +##### `id`Required +```typescript +public readonly id: string; +``` +- *Type:* string +The id of the rule to ignore. -## class PCIDSS321Checks +--- -Check for PCI DSS 3.2.1 compliance. Based on the PCI DSS 3.2.1 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-pci-dss.html. +##### `reason`Required -__Implements__: [IAspect](#aws-cdk-lib-iaspect) -__Extends__: [NagPack](#cdk-nag-nagpack) +```typescript +public readonly reason: string; +``` -### Initializer +- *Type:* string +The reason to ignore the rule (minimum 10 characters). +--- +##### `appliesTo`Optional -```ts -new PCIDSS321Checks(props?: NagPackProps) +```typescript +public readonly appliesTo: string | RegexAppliesTo[]; ``` -* **props** ([NagPackProps](#cdk-nag-nagpackprops)) *No description* - * **additionalLoggers** (Array<[INagLogger](#cdk-nag-inaglogger)>) Additional NagLoggers for logging rule validation outputs. __*Optional*__ - * **logIgnores** (boolean) Whether or not to log suppressed rule violations as informational messages (default: false). __*Optional*__ - * **reportFormats** (Array<[NagReportFormat](#cdk-nag-nagreportformat)>) If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). __*Optional*__ - * **reports** (boolean) Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). __*Optional*__ - * **suppressionIgnoreCondition** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) Conditionally prevent rules from being suppressed (default: no user provided condition). __*Optional*__ - * **verbose** (boolean) Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). __*Optional*__ +- *Type:* string | RegexAppliesTo[] +Rule specific granular suppressions. -### Methods +--- +### NagReportLine -#### visit(node) +#### Initializer -All aspects can visit an IConstruct. +```typescript +import { NagReportLine } from 'cdk-nag' -```ts -visit(node: IConstruct): void +const nagReportLine: NagReportLine = { ... } ``` -* **node** ([IConstruct](#constructs-iconstruct)) *No description* +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| compliance | string | *No description.* | +| exceptionReason | string | *No description.* | +| resourceId | string | *No description.* | +| ruleId | string | *No description.* | +| ruleInfo | string | *No description.* | +| ruleLevel | string | *No description.* | +--- +##### `compliance`Required +```typescript +public readonly compliance: string; +``` +- *Type:* string +--- -## class SuppressionIgnoreAlways +##### `exceptionReason`Required -Always ignore the suppression. +```typescript +public readonly exceptionReason: string; +``` + +- *Type:* string -__Implements__: [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) +--- -### Initializer +##### `resourceId`Required +```typescript +public readonly resourceId: string; +``` +- *Type:* string +--- -```ts -new SuppressionIgnoreAlways(triggerMessage: string) +##### `ruleId`Required + +```typescript +public readonly ruleId: string; ``` -* **triggerMessage** (string) *No description* +- *Type:* string +--- -### Methods +##### `ruleInfo`Required +```typescript +public readonly ruleInfo: string; +``` -#### createMessage(_input) +- *Type:* string +--- +##### `ruleLevel`Required -```ts -createMessage(_input: SuppressionIgnoreInput): string +```typescript +public readonly ruleLevel: string; ``` -* **_input** ([SuppressionIgnoreInput](#cdk-nag-suppressionignoreinput)) *No description* - * **findingId** (string) *No description* - * **reason** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleId** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* +- *Type:* string -__Returns__: -* string +--- +### NagReportLoggerProps +Props for the NagReportLogger. -## class SuppressionIgnoreAnd +#### Initializer -Ignore the suppression if all of the given INagSuppressionIgnore return a non-empty message. +```typescript +import { NagReportLoggerProps } from 'cdk-nag' -__Implements__: [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) +const nagReportLoggerProps: NagReportLoggerProps = { ... } +``` -### Initializer +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| formats | NagReportFormat[] | *No description.* | +--- +##### `formats`Required -```ts -new SuppressionIgnoreAnd(...SuppressionIgnoreAnds: INagSuppressionIgnore[]) +```typescript +public readonly formats: NagReportFormat[]; ``` -* **SuppressionIgnoreAnds** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) *No description* +- *Type:* NagReportFormat[] + +--- +### NagReportSchema -### Methods +#### Initializer +```typescript +import { NagReportSchema } from 'cdk-nag' -#### createMessage(input) +const nagReportSchema: NagReportSchema = { ... } +``` + +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| lines | NagReportLine[] | *No description.* | +--- -```ts -createMessage(input: SuppressionIgnoreInput): string +##### `lines`Required + +```typescript +public readonly lines: NagReportLine[]; ``` -* **input** ([SuppressionIgnoreInput](#cdk-nag-suppressionignoreinput)) *No description* - * **findingId** (string) *No description* - * **reason** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleId** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* +- *Type:* NagReportLine[] -__Returns__: -* string +--- +### RegexAppliesTo +A regular expression to apply to matching findings. -## class SuppressionIgnoreErrors +#### Initializer -Ignore Suppressions for Rules with a NagMessageLevel.ERROR. +```typescript +import { RegexAppliesTo } from 'cdk-nag' -__Implements__: [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) +const regexAppliesTo: RegexAppliesTo = { ... } +``` -### Initializer +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| regex | string | An ECMA-262 regex string. | +--- +##### `regex`Required -```ts -new SuppressionIgnoreErrors() +```typescript +public readonly regex: string; ``` +- *Type:* string +An ECMA-262 regex string. -### Methods +--- +### SuppressionIgnoreInput -#### createMessage(input) +Information about the NagRule and the relevant NagSuppression for the INagSuppressionIgnore. +#### Initializer +```typescript +import { SuppressionIgnoreInput } from 'cdk-nag' -```ts -createMessage(input: SuppressionIgnoreInput): string +const suppressionIgnoreInput: SuppressionIgnoreInput = { ... } ``` -* **input** ([SuppressionIgnoreInput](#cdk-nag-suppressionignoreinput)) *No description* - * **findingId** (string) *No description* - * **reason** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleId** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* +#### Properties -__Returns__: -* string +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| findingId | string | *No description.* | +| reason | string | *No description.* | +| resource | aws-cdk-lib.CfnResource | *No description.* | +| ruleId | string | *No description.* | +| ruleLevel | NagMessageLevel | *No description.* | +--- +##### `findingId`Required -## class SuppressionIgnoreNever +```typescript +public readonly findingId: string; +``` -Don't ignore the suppression. +- *Type:* string -__Implements__: [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) +--- -### Initializer +##### `reason`Required +```typescript +public readonly reason: string; +``` +- *Type:* string +--- -```ts -new SuppressionIgnoreNever() +##### `resource`Required + +```typescript +public readonly resource: CfnResource; ``` +- *Type:* aws-cdk-lib.CfnResource +--- -### Methods +##### `ruleId`Required +```typescript +public readonly ruleId: string; +``` -#### createMessage(_input) +- *Type:* string +--- +##### `ruleLevel`Required -```ts -createMessage(_input: SuppressionIgnoreInput): string +```typescript +public readonly ruleLevel: NagMessageLevel; ``` -* **_input** ([SuppressionIgnoreInput](#cdk-nag-suppressionignoreinput)) *No description* - * **findingId** (string) *No description* - * **reason** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleId** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* +- *Type:* NagMessageLevel -__Returns__: -* string +--- +## Classes +### AnnotationLogger -## class SuppressionIgnoreOr - -Ignore the suppression if any of the given INagSuppressionIgnore return a non-empty message. +- *Implements:* INagLogger -__Implements__: [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) +A NagLogger that outputs to the CDK Annotations system. -### Initializer +#### Initializers +```typescript +import { AnnotationLogger } from 'cdk-nag' +new AnnotationLogger(props?: AnnotationLoggerProps) +``` +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| props | AnnotationLoggerProps | *No description.* | -```ts -new SuppressionIgnoreOr(...orSuppressionIgnores: INagSuppressionIgnore[]) -``` +--- -* **orSuppressionIgnores** ([INagSuppressionIgnore](#cdk-nag-inagsuppressionignore)) *No description* +##### `props`Optional +- *Type:* AnnotationLoggerProps -### Methods +--- +#### Methods -#### createMessage(input) +| **Name** | **Description** | +| --- | --- | +| onCompliance | Called when a CfnResource passes the compliance check for a given rule. | +| onError | Called when a rule throws an error during while validating a CfnResource for compliance. | +| onNonCompliance | Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. | +| onNotApplicable | Called when a rule does not apply to the given CfnResource. | +| onSuppressed | Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. | +| onSuppressedError | Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. | +--- +##### `onCompliance` -```ts -createMessage(input: SuppressionIgnoreInput): string +```typescript +public onCompliance(_data: NagLoggerComplianceData): void ``` -* **input** ([SuppressionIgnoreInput](#cdk-nag-suppressionignoreinput)) *No description* - * **findingId** (string) *No description* - * **reason** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleId** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - -__Returns__: -* string +Called when a CfnResource passes the compliance check for a given rule. +###### `_data`Required +- *Type:* NagLoggerComplianceData -## struct AnnotationLoggerProps +--- +##### `onError` -Props for the AnnotationLogger. +```typescript +public onError(data: NagLoggerErrorData): void +``` +Called when a rule throws an error during while validating a CfnResource for compliance. +###### `data`Required -Name | Type | Description ------|------|------------- -**logIgnores**? | boolean | Whether or not to log suppressed rule violations as informational messages (default: false).
__*Optional*__ -**verbose**? | boolean | Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages.
__*Optional*__ +- *Type:* NagLoggerErrorData +--- +##### `onNonCompliance` -## interface IApplyRule +```typescript +public onNonCompliance(data: NagLoggerNonComplianceData): void +``` +Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. -Interface for JSII interoperability for passing parameters and the Rule Callback to @applyRule method. +###### `data`Required -### Properties +- *Type:* NagLoggerNonComplianceData +--- -Name | Type | Description ------|------|------------- -**explanation** | string | Why the rule exists. -**info** | string | Why the rule was triggered. -**level** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | The annotations message level to apply to the rule if triggered. -**node** | [CfnResource](#aws-cdk-lib-cfnresource) | The CfnResource to check. -**ignoreSuppressionCondition**? | [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) | A condition in which a suppression should be ignored.
__*Optional*__ -**ruleSuffixOverride**? | string | Override for the suffix of the Rule ID for this rule.
__*Optional*__ +##### `onNotApplicable` -### Methods +```typescript +public onNotApplicable(_data: NagLoggerNotApplicableData): void +``` +Called when a rule does not apply to the given CfnResource. -#### rule(node) +###### `_data`Required -The callback to the rule. +- *Type:* NagLoggerNotApplicableData -```ts -rule(node: CfnResource): NagRuleCompliance | Array -``` +--- -* **node** ([CfnResource](#aws-cdk-lib-cfnresource)) The CfnResource to check. +##### `onSuppressed` -__Returns__: -* [NagRuleCompliance](#cdk-nag-nagrulecompliance) | Array +```typescript +public onSuppressed(data: NagLoggerSuppressedData): void +``` +Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. +###### `data`Required -## interface INagLogger +- *Type:* NagLoggerSuppressedData -__Implemented by__: [AnnotationLogger](#cdk-nag-annotationlogger), [NagReportLogger](#cdk-nag-nagreportlogger) +--- -Interface for creating NagSuppression Ignores. -### Methods +##### `onSuppressedError` +```typescript +public onSuppressedError(data: NagLoggerSuppressedErrorData): void +``` -#### onCompliance(data) +Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. -Called when a CfnResource passes the compliance check for a given rule. +###### `data`Required -```ts -onCompliance(data: NagLoggerComplianceData): void -``` +- *Type:* NagLoggerSuppressedErrorData -* **data** ([NagLoggerComplianceData](#cdk-nag-nagloggercompliancedata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* +--- +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| logIgnores | boolean | *No description.* | +| verbose | boolean | *No description.* | +| suppressionId | string | *No description.* | -#### onError(data) +--- -Called when a rule throws an error during while validating a CfnResource for compliance. +##### `logIgnores`Required -```ts -onError(data: NagLoggerErrorData): void +```typescript +public readonly logIgnores: boolean; ``` -* **data** ([NagLoggerErrorData](#cdk-nag-nagloggererrordata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **errorMessage** (string) *No description* +- *Type:* boolean +--- +##### `verbose`Required +```typescript +public readonly verbose: boolean; +``` -#### onNonCompliance(data) +- *Type:* boolean -Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. +--- -```ts -onNonCompliance(data: NagLoggerNonComplianceData): void +##### `suppressionId`Required + +```typescript +public readonly suppressionId: string; ``` -* **data** ([NagLoggerNonComplianceData](#cdk-nag-nagloggernoncompliancedata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **findingId** (string) *No description* +- *Type:* string + +--- +### AwsSolutionsChecks +Check Best practices based on AWS Solutions Security Matrix. -#### onNotApplicable(data) +#### Initializers -Called when a rule does not apply to the given CfnResource. +```typescript +import { AwsSolutionsChecks } from 'cdk-nag' -```ts -onNotApplicable(data: NagLoggerNotApplicableData): void +new AwsSolutionsChecks(props?: NagPackProps) ``` -* **data** ([NagLoggerNotApplicableData](#cdk-nag-nagloggernotapplicabledata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| props | NagPackProps | *No description.* | +--- +##### `props`Optional +- *Type:* NagPackProps -#### onSuppressed(data) +--- -Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. +#### Methods -```ts -onSuppressed(data: NagLoggerSuppressedData): void -``` +| **Name** | **Description** | +| --- | --- | +| visit | All aspects can visit an IConstruct. | -* **data** ([NagLoggerSuppressedData](#cdk-nag-nagloggersuppresseddata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **findingId** (string) *No description* - * **suppressionReason** (string) *No description* +--- +##### `visit` +```typescript +public visit(node: IConstruct): void +``` +All aspects can visit an IConstruct. -#### onSuppressedError(data) +###### `node`Required -Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. +- *Type:* constructs.IConstruct + +--- -```ts -onSuppressedError(data: NagLoggerSuppressedErrorData): void -``` -* **data** ([NagLoggerSuppressedErrorData](#cdk-nag-nagloggersuppressederrordata)) *No description* - * **nagPackName** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleExplanation** (string) *No description* - * **ruleId** (string) *No description* - * **ruleInfo** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* - * **ruleOriginalName** (string) *No description* - * **errorMessage** (string) *No description* - * **errorSuppressionReason** (string) *No description* +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| readPackName | string | *No description.* | +--- +##### `readPackName`Required +```typescript +public readonly readPackName: string; +``` +- *Type:* string -## interface INagSuppressionIgnore +--- -__Implemented by__: [SuppressionIgnoreAlways](#cdk-nag-suppressionignorealways), [SuppressionIgnoreAnd](#cdk-nag-suppressionignoreand), [SuppressionIgnoreErrors](#cdk-nag-suppressionignoreerrors), [SuppressionIgnoreNever](#cdk-nag-suppressionignorenever), [SuppressionIgnoreOr](#cdk-nag-suppressionignoreor) -Interface for creating NagSuppression Ignores. -### Methods +### HIPAASecurityChecks +Check for HIPAA Security compliance. -#### createMessage(input) +Based on the HIPAA Security AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-hipaa_security.html +#### Initializers +```typescript +import { HIPAASecurityChecks } from 'cdk-nag' -```ts -createMessage(input: SuppressionIgnoreInput): string +new HIPAASecurityChecks(props?: NagPackProps) ``` -* **input** ([SuppressionIgnoreInput](#cdk-nag-suppressionignoreinput)) *No description* - * **findingId** (string) *No description* - * **reason** (string) *No description* - * **resource** ([CfnResource](#aws-cdk-lib-cfnresource)) *No description* - * **ruleId** (string) *No description* - * **ruleLevel** ([NagMessageLevel](#cdk-nag-nagmessagelevel)) *No description* +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| props | NagPackProps | *No description.* | -__Returns__: -* string +--- +##### `props`Optional +- *Type:* NagPackProps -## struct NagLoggerBaseData +--- +#### Methods -Shared data for all INagLogger methods. +| **Name** | **Description** | +| --- | --- | +| visit | All aspects can visit an IConstruct. | +--- +##### `visit` -Name | Type | Description ------|------|------------- -**nagPackName** | string | -**resource** | [CfnResource](#aws-cdk-lib-cfnresource) | -**ruleExplanation** | string | -**ruleId** | string | -**ruleInfo** | string | -**ruleLevel** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | -**ruleOriginalName** | string | +```typescript +public visit(node: IConstruct): void +``` +All aspects can visit an IConstruct. +###### `node`Required -## struct NagLoggerComplianceData +- *Type:* constructs.IConstruct +--- -Data for onCompliance method of an INagLogger. +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| readPackName | string | *No description.* | -Name | Type | Description ------|------|------------- -**nagPackName** | string | -**resource** | [CfnResource](#aws-cdk-lib-cfnresource) | -**ruleExplanation** | string | -**ruleId** | string | -**ruleInfo** | string | -**ruleLevel** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | -**ruleOriginalName** | string | +--- +##### `readPackName`Required +```typescript +public readonly readPackName: string; +``` -## struct NagLoggerErrorData +- *Type:* string +--- -Data for onError method of an INagLogger. +### NagPack +- *Implements:* aws-cdk-lib.IAspect -Name | Type | Description ------|------|------------- -**errorMessage** | string | -**nagPackName** | string | -**resource** | [CfnResource](#aws-cdk-lib-cfnresource) | -**ruleExplanation** | string | -**ruleId** | string | -**ruleInfo** | string | -**ruleLevel** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | -**ruleOriginalName** | string | +Base class for all rule packs. +#### Initializers +```typescript +import { NagPack } from 'cdk-nag' -## struct NagLoggerNonComplianceData +new NagPack(props?: NagPackProps) +``` +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| props | NagPackProps | *No description.* | -Data for onNonCompliance method of an INagLogger. +--- +##### `props`Optional +- *Type:* NagPackProps -Name | Type | Description ------|------|------------- -**findingId** | string | -**nagPackName** | string | -**resource** | [CfnResource](#aws-cdk-lib-cfnresource) | -**ruleExplanation** | string | -**ruleId** | string | -**ruleInfo** | string | -**ruleLevel** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | -**ruleOriginalName** | string | +--- +#### Methods +| **Name** | **Description** | +| --- | --- | +| visit | All aspects can visit an IConstruct. | -## struct NagLoggerNotApplicableData +--- +##### `visit` -Data for onNotApplicable method of an INagLogger. +```typescript +public visit(node: IConstruct): void +``` +All aspects can visit an IConstruct. +###### `node`Required -Name | Type | Description ------|------|------------- -**nagPackName** | string | -**resource** | [CfnResource](#aws-cdk-lib-cfnresource) | -**ruleExplanation** | string | -**ruleId** | string | -**ruleInfo** | string | -**ruleLevel** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | -**ruleOriginalName** | string | +- *Type:* constructs.IConstruct +--- -## struct NagLoggerSuppressedData +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| readPackName | string | *No description.* | -Data for onSuppressed method of an INagLogger. +--- +##### `readPackName`Required +```typescript +public readonly readPackName: string; +``` -Name | Type | Description ------|------|------------- -**findingId** | string | -**nagPackName** | string | -**resource** | [CfnResource](#aws-cdk-lib-cfnresource) | -**ruleExplanation** | string | -**ruleId** | string | -**ruleInfo** | string | -**ruleLevel** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | -**ruleOriginalName** | string | -**suppressionReason** | string | +- *Type:* string +--- -## struct NagLoggerSuppressedErrorData +### NagReportLogger +- *Implements:* INagLogger -Data for onSuppressedError method of an INagLogger. +A NagLogger that creates compliance reports. +#### Initializers +```typescript +import { NagReportLogger } from 'cdk-nag' -Name | Type | Description ------|------|------------- -**errorMessage** | string | -**errorSuppressionReason** | string | -**nagPackName** | string | -**resource** | [CfnResource](#aws-cdk-lib-cfnresource) | -**ruleExplanation** | string | -**ruleId** | string | -**ruleInfo** | string | -**ruleLevel** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | -**ruleOriginalName** | string | +new NagReportLogger(props: NagReportLoggerProps) +``` +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| props | NagReportLoggerProps | *No description.* | +--- -## struct NagPackProps +##### `props`Required +- *Type:* NagReportLoggerProps -Interface for creating a NagPack. +--- + +#### Methods +| **Name** | **Description** | +| --- | --- | +| getFormatStacks | *No description.* | +| onCompliance | Called when a CfnResource passes the compliance check for a given rule. | +| onError | Called when a rule throws an error during while validating a CfnResource for compliance. | +| onNonCompliance | Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. | +| onNotApplicable | Called when a rule does not apply to the given CfnResource. | +| onSuppressed | Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. | +| onSuppressedError | Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. | +--- -Name | Type | Description ------|------|------------- -**additionalLoggers**? | Array<[INagLogger](#cdk-nag-inaglogger)> | Additional NagLoggers for logging rule validation outputs.
__*Optional*__ -**logIgnores**? | boolean | Whether or not to log suppressed rule violations as informational messages (default: false).
__*Optional*__ -**reportFormats**? | Array<[NagReportFormat](#cdk-nag-nagreportformat)> | If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV).
__*Optional*__ -**reports**? | boolean | Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true).
__*Optional*__ -**suppressionIgnoreCondition**? | [INagSuppressionIgnore](#cdk-nag-inagsuppressionignore) | Conditionally prevent rules from being suppressed (default: no user provided condition).
__*Optional*__ -**verbose**? | boolean | Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false).
__*Optional*__ +##### `getFormatStacks` +```typescript +public getFormatStacks(format: NagReportFormat): string[] +``` +###### `format`Required -## struct NagPackSuppression +- *Type:* NagReportFormat +--- -Interface for creating a rule suppression. +##### `onCompliance` +```typescript +public onCompliance(data: NagLoggerComplianceData): void +``` +Called when a CfnResource passes the compliance check for a given rule. -Name | Type | Description ------|------|------------- -**id** | string | The id of the rule to ignore. -**reason** | string | The reason to ignore the rule (minimum 10 characters). -**appliesTo**? | Array | Rule specific granular suppressions.
__*Optional*__ +###### `data`Required +- *Type:* NagLoggerComplianceData +--- -## struct NagReportLine +##### `onError` +```typescript +public onError(data: NagLoggerErrorData): void +``` +Called when a rule throws an error during while validating a CfnResource for compliance. +###### `data`Required +- *Type:* NagLoggerErrorData +--- -Name | Type | Description ------|------|------------- -**compliance** | string | -**exceptionReason** | string | -**resourceId** | string | -**ruleId** | string | -**ruleInfo** | string | -**ruleLevel** | string | +##### `onNonCompliance` +```typescript +public onNonCompliance(data: NagLoggerNonComplianceData): void +``` +Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. -## struct NagReportLoggerProps +###### `data`Required +- *Type:* NagLoggerNonComplianceData -Props for the NagReportLogger. +--- +##### `onNotApplicable` +```typescript +public onNotApplicable(data: NagLoggerNotApplicableData): void +``` -Name | Type | Description ------|------|------------- -**formats** | Array<[NagReportFormat](#cdk-nag-nagreportformat)> | +Called when a rule does not apply to the given CfnResource. +###### `data`Required +- *Type:* NagLoggerNotApplicableData -## struct NagReportSchema +--- +##### `onSuppressed` +```typescript +public onSuppressed(data: NagLoggerSuppressedData): void +``` +Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. +###### `data`Required +- *Type:* NagLoggerSuppressedData -Name | Type | Description ------|------|------------- -**lines** | Array<[NagReportLine](#cdk-nag-nagreportline)> | +--- +##### `onSuppressedError` +```typescript +public onSuppressedError(data: NagLoggerSuppressedErrorData): void +``` -## struct RegexAppliesTo +Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. +###### `data`Required -A regular expression to apply to matching findings. +- *Type:* NagLoggerSuppressedErrorData +--- -Name | Type | Description ------|------|------------- -**regex** | string | An ECMA-262 regex string. +#### Properties +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| formats | NagReportFormat[] | *No description.* | +--- -## struct SuppressionIgnoreInput +##### `formats`Required +```typescript +public readonly formats: NagReportFormat[]; +``` -Information about the NagRule and the relevant NagSuppression for the INagSuppressionIgnore. +- *Type:* NagReportFormat[] +--- -Name | Type | Description ------|------|------------- -**findingId** | string | -**reason** | string | -**resource** | [CfnResource](#aws-cdk-lib-cfnresource) | -**ruleId** | string | -**ruleLevel** | [NagMessageLevel](#cdk-nag-nagmessagelevel) | +### NagRules +Helper class with methods for rule creation. +#### Initializers -## enum NagMessageLevel +```typescript +import { NagRules } from 'cdk-nag' -The severity level of the rule. +new NagRules() +``` -Name | Description ------|----- -**WARN** | -**ERROR** | +| **Name** | **Type** | **Description** | +| --- | --- | --- | +--- -## enum NagReportFormat -Possible output formats of the NagReport. +#### Static Functions -Name | Description ------|----- -**CSV** | -**JSON** | +| **Name** | **Description** | +| --- | --- | +| resolveIfPrimitive | Use in cases where a primitive value must be known to pass a rule. | +| resolveResourceFromInstrinsic | Use in cases where a token resolves to an intrinsic function and the referenced resource must be known to pass a rule. | +--- -## enum NagRuleCompliance +##### `resolveIfPrimitive` -The compliance level of a resource in relation to a rule. +```typescript +import { NagRules } from 'cdk-nag' -Name | Description ------|----- -**COMPLIANT** | -**NON_COMPLIANT** | -**NOT_APPLICABLE** | +NagRules.resolveIfPrimitive(node: CfnResource, parameter: any) +``` +Use in cases where a primitive value must be known to pass a rule. -## enum NagRulePostValidationStates +https://developer.mozilla.org/en-US/docs/Glossary/Primitive + +###### `node`Required + +- *Type:* aws-cdk-lib.CfnResource + +The CfnResource to check. + +--- + +###### `parameter`Required + +- *Type:* any + +The value to attempt to resolve. + +--- + +##### `resolveResourceFromInstrinsic` + +```typescript +import { NagRules } from 'cdk-nag' + +NagRules.resolveResourceFromInstrinsic(node: CfnResource, parameter: any) +``` + +Use in cases where a token resolves to an intrinsic function and the referenced resource must be known to pass a rule. + +###### `node`Required + +- *Type:* aws-cdk-lib.CfnResource + +The CfnResource to check. + +--- + +###### `parameter`Required + +- *Type:* any + +The value to attempt to resolve. + +--- + + + +### NagSuppressions + +Helper class with methods to add cdk-nag suppressions to cdk resources. + +#### Initializers + +```typescript +import { NagSuppressions } from 'cdk-nag' + +new NagSuppressions() +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | + +--- + + +#### Static Functions + +| **Name** | **Description** | +| --- | --- | +| addResourceSuppressions | Add cdk-nag suppressions to a CfnResource and optionally its children. | +| addResourceSuppressionsByPath | Add cdk-nag suppressions to a CfnResource and optionally its children via its path. | +| addStackSuppressions | Apply cdk-nag suppressions to a Stack and optionally nested stacks. | + +--- + +##### `addResourceSuppressions` + +```typescript +import { NagSuppressions } from 'cdk-nag' + +NagSuppressions.addResourceSuppressions(construct: IConstruct | IConstruct[], suppressions: NagPackSuppression[], applyToChildren?: boolean) +``` + +Add cdk-nag suppressions to a CfnResource and optionally its children. + +###### `construct`Required + +- *Type:* constructs.IConstruct | constructs.IConstruct[] + +The IConstruct(s) to apply the suppression to. + +--- + +###### `suppressions`Required + +- *Type:* NagPackSuppression[] + +A list of suppressions to apply to the resource. + +--- + +###### `applyToChildren`Optional + +- *Type:* boolean + +Apply the suppressions to children CfnResources (default:false). + +--- + +##### `addResourceSuppressionsByPath` + +```typescript +import { NagSuppressions } from 'cdk-nag' + +NagSuppressions.addResourceSuppressionsByPath(stack: Stack, path: string | string[], suppressions: NagPackSuppression[], applyToChildren?: boolean) +``` + +Add cdk-nag suppressions to a CfnResource and optionally its children via its path. + +###### `stack`Required + +- *Type:* aws-cdk-lib.Stack + +The Stack the construct belongs to. + +--- + +###### `path`Required + +- *Type:* string | string[] + +The path(s) to the construct in the provided stack. + +--- + +###### `suppressions`Required + +- *Type:* NagPackSuppression[] + +A list of suppressions to apply to the resource. + +--- + +###### `applyToChildren`Optional + +- *Type:* boolean + +Apply the suppressions to children CfnResources (default:false). + +--- + +##### `addStackSuppressions` + +```typescript +import { NagSuppressions } from 'cdk-nag' + +NagSuppressions.addStackSuppressions(stack: Stack, suppressions: NagPackSuppression[], applyToNestedStacks?: boolean) +``` + +Apply cdk-nag suppressions to a Stack and optionally nested stacks. + +###### `stack`Required + +- *Type:* aws-cdk-lib.Stack + +The Stack to apply the suppression to. + +--- + +###### `suppressions`Required + +- *Type:* NagPackSuppression[] + +A list of suppressions to apply to the stack. + +--- + +###### `applyToNestedStacks`Optional + +- *Type:* boolean + +Apply the suppressions to children stacks (default:false). + +--- + + + +### NIST80053R4Checks + +Check for NIST 800-53 rev 4 compliance. + +Based on the NIST 800-53 rev 4 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_4.html + +#### Initializers + +```typescript +import { NIST80053R4Checks } from 'cdk-nag' + +new NIST80053R4Checks(props?: NagPackProps) +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| props | NagPackProps | *No description.* | + +--- + +##### `props`Optional + +- *Type:* NagPackProps + +--- + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| visit | All aspects can visit an IConstruct. | + +--- + +##### `visit` + +```typescript +public visit(node: IConstruct): void +``` + +All aspects can visit an IConstruct. + +###### `node`Required + +- *Type:* constructs.IConstruct + +--- + + +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| readPackName | string | *No description.* | + +--- + +##### `readPackName`Required + +```typescript +public readonly readPackName: string; +``` + +- *Type:* string + +--- + + +### NIST80053R5Checks + +Check for NIST 800-53 rev 5 compliance. + +Based on the NIST 800-53 rev 5 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_5.html + +#### Initializers + +```typescript +import { NIST80053R5Checks } from 'cdk-nag' + +new NIST80053R5Checks(props?: NagPackProps) +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| props | NagPackProps | *No description.* | + +--- + +##### `props`Optional + +- *Type:* NagPackProps + +--- + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| visit | All aspects can visit an IConstruct. | + +--- + +##### `visit` + +```typescript +public visit(node: IConstruct): void +``` + +All aspects can visit an IConstruct. + +###### `node`Required + +- *Type:* constructs.IConstruct + +--- + + +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| readPackName | string | *No description.* | + +--- + +##### `readPackName`Required + +```typescript +public readonly readPackName: string; +``` + +- *Type:* string + +--- + + +### PCIDSS321Checks + +Check for PCI DSS 3.2.1 compliance. Based on the PCI DSS 3.2.1 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-pci-dss.html. + +#### Initializers + +```typescript +import { PCIDSS321Checks } from 'cdk-nag' + +new PCIDSS321Checks(props?: NagPackProps) +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| props | NagPackProps | *No description.* | + +--- + +##### `props`Optional + +- *Type:* NagPackProps + +--- + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| visit | All aspects can visit an IConstruct. | + +--- + +##### `visit` + +```typescript +public visit(node: IConstruct): void +``` + +All aspects can visit an IConstruct. + +###### `node`Required + +- *Type:* constructs.IConstruct + +--- + + +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| readPackName | string | *No description.* | + +--- + +##### `readPackName`Required + +```typescript +public readonly readPackName: string; +``` + +- *Type:* string + +--- + + +### SuppressionIgnoreAlways + +- *Implements:* INagSuppressionIgnore + +Always ignore the suppression. + +#### Initializers + +```typescript +import { SuppressionIgnoreAlways } from 'cdk-nag' + +new SuppressionIgnoreAlways(triggerMessage: string) +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| triggerMessage | string | *No description.* | + +--- + +##### `triggerMessage`Required + +- *Type:* string + +--- + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| createMessage | *No description.* | + +--- + +##### `createMessage` + +```typescript +public createMessage(_input: SuppressionIgnoreInput): string +``` + +###### `_input`Required + +- *Type:* SuppressionIgnoreInput + +--- + + + + +### SuppressionIgnoreAnd + +- *Implements:* INagSuppressionIgnore + +Ignore the suppression if all of the given INagSuppressionIgnore return a non-empty message. + +#### Initializers + +```typescript +import { SuppressionIgnoreAnd } from 'cdk-nag' + +new SuppressionIgnoreAnd(SuppressionIgnoreAnds: INagSuppressionIgnore) +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| SuppressionIgnoreAnds | INagSuppressionIgnore | *No description.* | + +--- + +##### `SuppressionIgnoreAnds`Required + +- *Type:* INagSuppressionIgnore + +--- + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| createMessage | *No description.* | + +--- + +##### `createMessage` + +```typescript +public createMessage(input: SuppressionIgnoreInput): string +``` + +###### `input`Required + +- *Type:* SuppressionIgnoreInput + +--- + + + + +### SuppressionIgnoreErrors + +- *Implements:* INagSuppressionIgnore + +Ignore Suppressions for Rules with a NagMessageLevel.ERROR. + +#### Initializers + +```typescript +import { SuppressionIgnoreErrors } from 'cdk-nag' + +new SuppressionIgnoreErrors() +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | + +--- + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| createMessage | *No description.* | + +--- + +##### `createMessage` + +```typescript +public createMessage(input: SuppressionIgnoreInput): string +``` + +###### `input`Required + +- *Type:* SuppressionIgnoreInput + +--- + + + + +### SuppressionIgnoreNever + +- *Implements:* INagSuppressionIgnore + +Don't ignore the suppression. + +#### Initializers + +```typescript +import { SuppressionIgnoreNever } from 'cdk-nag' + +new SuppressionIgnoreNever() +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | + +--- + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| createMessage | *No description.* | + +--- + +##### `createMessage` + +```typescript +public createMessage(_input: SuppressionIgnoreInput): string +``` + +###### `_input`Required + +- *Type:* SuppressionIgnoreInput + +--- + + + + +### SuppressionIgnoreOr + +- *Implements:* INagSuppressionIgnore + +Ignore the suppression if any of the given INagSuppressionIgnore return a non-empty message. + +#### Initializers + +```typescript +import { SuppressionIgnoreOr } from 'cdk-nag' + +new SuppressionIgnoreOr(orSuppressionIgnores: INagSuppressionIgnore) +``` + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| orSuppressionIgnores | INagSuppressionIgnore | *No description.* | + +--- + +##### `orSuppressionIgnores`Required + +- *Type:* INagSuppressionIgnore + +--- + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| createMessage | *No description.* | + +--- + +##### `createMessage` + +```typescript +public createMessage(input: SuppressionIgnoreInput): string +``` + +###### `input`Required + +- *Type:* SuppressionIgnoreInput + +--- + + + + +## Protocols + +### IApplyRule + +- *Implemented By:* IApplyRule + +Interface for JSII interoperability for passing parameters and the Rule Callback to @applyRule method. + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| rule | The callback to the rule. | + +--- + +##### `rule` + +```typescript +public rule(node: CfnResource): NagRuleCompliance | string[] +``` + +The callback to the rule. + +###### `node`Required + +- *Type:* aws-cdk-lib.CfnResource + +The CfnResource to check. + +--- + +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| explanation | string | Why the rule exists. | +| info | string | Why the rule was triggered. | +| level | NagMessageLevel | The annotations message level to apply to the rule if triggered. | +| node | aws-cdk-lib.CfnResource | The CfnResource to check. | +| ignoreSuppressionCondition | INagSuppressionIgnore | A condition in which a suppression should be ignored. | +| ruleSuffixOverride | string | Override for the suffix of the Rule ID for this rule. | + +--- + +##### `explanation`Required + +```typescript +public readonly explanation: string; +``` + +- *Type:* string + +Why the rule exists. + +--- + +##### `info`Required + +```typescript +public readonly info: string; +``` + +- *Type:* string + +Why the rule was triggered. + +--- + +##### `level`Required + +```typescript +public readonly level: NagMessageLevel; +``` + +- *Type:* NagMessageLevel + +The annotations message level to apply to the rule if triggered. + +--- + +##### `node`Required + +```typescript +public readonly node: CfnResource; +``` + +- *Type:* aws-cdk-lib.CfnResource + +The CfnResource to check. + +--- + +##### `ignoreSuppressionCondition`Optional + +```typescript +public readonly ignoreSuppressionCondition: INagSuppressionIgnore; +``` + +- *Type:* INagSuppressionIgnore + +A condition in which a suppression should be ignored. + +--- + +##### `ruleSuffixOverride`Optional + +```typescript +public readonly ruleSuffixOverride: string; +``` + +- *Type:* string + +Override for the suffix of the Rule ID for this rule. + +--- + +### INagLogger + +- *Implemented By:* AnnotationLogger, NagReportLogger, INagLogger + +Interface for creating NagSuppression Ignores. + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| onCompliance | Called when a CfnResource passes the compliance check for a given rule. | +| onError | Called when a rule throws an error during while validating a CfnResource for compliance. | +| onNonCompliance | Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. | +| onNotApplicable | Called when a rule does not apply to the given CfnResource. | +| onSuppressed | Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. | +| onSuppressedError | Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. | + +--- + +##### `onCompliance` + +```typescript +public onCompliance(data: NagLoggerComplianceData): void +``` + +Called when a CfnResource passes the compliance check for a given rule. + +###### `data`Required + +- *Type:* NagLoggerComplianceData + +--- + +##### `onError` + +```typescript +public onError(data: NagLoggerErrorData): void +``` + +Called when a rule throws an error during while validating a CfnResource for compliance. + +###### `data`Required + +- *Type:* NagLoggerErrorData + +--- + +##### `onNonCompliance` + +```typescript +public onNonCompliance(data: NagLoggerNonComplianceData): void +``` + +Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. + +###### `data`Required + +- *Type:* NagLoggerNonComplianceData + +--- + +##### `onNotApplicable` + +```typescript +public onNotApplicable(data: NagLoggerNotApplicableData): void +``` + +Called when a rule does not apply to the given CfnResource. + +###### `data`Required + +- *Type:* NagLoggerNotApplicableData + +--- + +##### `onSuppressed` + +```typescript +public onSuppressed(data: NagLoggerSuppressedData): void +``` + +Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. + +###### `data`Required + +- *Type:* NagLoggerSuppressedData + +--- + +##### `onSuppressedError` + +```typescript +public onSuppressedError(data: NagLoggerSuppressedErrorData): void +``` + +Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. + +###### `data`Required + +- *Type:* NagLoggerSuppressedErrorData + +--- + + +### INagSuppressionIgnore + +- *Implemented By:* SuppressionIgnoreAlways, SuppressionIgnoreAnd, SuppressionIgnoreErrors, SuppressionIgnoreNever, SuppressionIgnoreOr, INagSuppressionIgnore + +Interface for creating NagSuppression Ignores. + +#### Methods + +| **Name** | **Description** | +| --- | --- | +| createMessage | *No description.* | + +--- + +##### `createMessage` + +```typescript +public createMessage(input: SuppressionIgnoreInput): string +``` + +###### `input`Required + +- *Type:* SuppressionIgnoreInput + +--- + + +## Enums + +### NagMessageLevel + +The severity level of the rule. + +#### Members + +| **Name** | **Description** | +| --- | --- | +| WARN | *No description.* | +| ERROR | *No description.* | + +--- + +##### `WARN` + +--- + + +##### `ERROR` + +--- + + +### NagReportFormat + +Possible output formats of the NagReport. + +#### Members + +| **Name** | **Description** | +| --- | --- | +| CSV | *No description.* | +| JSON | *No description.* | + +--- + +##### `CSV` + +--- + + +##### `JSON` + +--- + + +### NagRuleCompliance + +The compliance level of a resource in relation to a rule. + +#### Members + +| **Name** | **Description** | +| --- | --- | +| COMPLIANT | *No description.* | +| NON_COMPLIANT | *No description.* | +| NOT_APPLICABLE | *No description.* | + +--- + +##### `COMPLIANT` + +--- + + +##### `NON_COMPLIANT` + +--- + + +##### `NOT_APPLICABLE` + +--- + + +### NagRulePostValidationStates + +Additional states a rule can be in post compliance validation. + +#### Members + +| **Name** | **Description** | +| --- | --- | +| SUPPRESSED | *No description.* | +| UNKNOWN | *No description.* | + +--- + +##### `SUPPRESSED` + +--- -Additional states a rule can be in post compliance validation. -Name | Description ------|----- -**SUPPRESSED** | -**UNKNOWN** | +##### `UNKNOWN` +---