corymhall / eslint-plugin-awscdk

👋 Hello! I'm Cory.

• 🔭 I’m currently working at Pulumi
• 💥 Former AWS CDK team member
• 🌱 I’m currently learning about Pulumi!
• ⚡ Fun fact: I love Neovim ❤️
• 📘 I have a blog

---

📝 Latest Blog Posts

• CDK Diff GitHub Action
• Go Construct Patterns
• Building, bundling, and deploying applications with the AWS CDK
• Bootstrapping multiple AWS accounts for AWS CDK using CloudFormation StackSets

---

---

eslint-plugin-awscdk's Issues

setup testing

Setup an action to run npm test. You know so I know when I break things :-)

KMS.2 IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys

Category: Foundational

Rules:

• KMS.2 IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys
• KMS.1 IAM customer managed policies should not allow decryption actions on all KMS keys

The current rule checks all PolicyStatements, but we need to either find a way to check whether the PolicyStatement is part of a policy attached to an IAM principal or handle this some other way (change it to a warning, etc)

Determine defaults

We need to determine:

1. What are the default configs that we will provide
2. What are the default warning levels for the rules

In the docs there are 4 levels of severity, low, medium, high, critical.

Support for aws-cdk v2

The plugin is not working because aws-cdk v2 overhauled the bundling of the packages.

CloudFront.2 CloudFront distributions should have origin access identity enabled

This one will be more difficult. The Distribution construct will setup an OAI based on whether the bucket is setup as website hosting or not.

incorrect

const bucket = new s3.Bucket(this, 'WebsiteBucket', {
  websiteIndexDocument: 'index.html', // enables static website hosting
});

const s3Origin = new cloudfront_origins.S3Origin(this, 'S3Origin', bucket);

new cloudfront.Distribution(this, 'Distribution', {
  defaultBehavior: {
    origin: s3Origin,
    ...
  },
});

correct

const bucket = new s3.Bucket(this, 'WebsiteBucket');

const s3Origin = new cloudfront_origins.S3Origin(this, 'S3Origin', bucket);

new cloudfront.Distribution(this, 'Distribution', {
  defaultBehavior: {
    origin: s3Origin,
    ...
  },
});

Amazon S3 permissions granted to other AWS accounts in bucket policies should be restricted

Need to find a way to search for accountIDs in strings. For example:

new iam.PolicyStatement({
  principals: [
    new iam.ArnPrincipal('are:aws:iam::1111111111:role/mycrossaccountrole'),
    // or
    new iam.ArnPrincipal(stack.formatArn({
      account: '111111111',
      ...,
      })),
  ],
})

1 option is to force people to use the formatArn method and just make sure they don't provide the account parameter, which will default it to the current account.

KMS.1 IAM customer managed policies should not allow decryption actions on all KMS key

Category: Foundational

Rule: KMS.1 IAM customer managed policies should not allow decryption actions on all KMS keys