{"id":2426,"library":"cdk-nag","title":"CDK Nag","description":"cdk-nag is an open-source library for the AWS Cloud Development Kit (CDK) that checks CDK applications for security and compliance best practices. It functions as a linter for Infrastructure as Code, leveraging CDK Aspects to validate constructs against various rule packs like AWS Solutions, HIPAA, NIST, and PCI DSS. The library helps identify issues such as unencrypted S3 buckets, overly permissive IAM policies, and public databases before deployment. It is currently at version 2.37.55 and actively maintained with a regular release cadence.","status":"active","version":"2.37.55","language":"python","source_language":"en","source_url":"https://github.com/cdklabs/cdk-nag.git","tags":["aws","cdk","security","iac","linting","best practices","compliance"],"install":[{"cmd":"pip install cdk-nag","lang":"bash","label":"Install cdk-nag"}],"dependencies":[{"reason":"cdk-nag is an extension for AWS CDK applications and requires the AWS CDK library to function. Ensure it's installed and compatible with your cdk-nag version.","package":"aws-cdk-lib","optional":false},{"reason":"The library officially supports Python versions compatible with '~=3.9'.","package":"Python ~=3.9","optional":false}],"imports":[{"symbol":"AwsSolutionsChecks","correct":"from cdk_nag import AwsSolutionsChecks"},{"symbol":"NagSuppressions","correct":"from cdk_nag import NagSuppressions"},{"symbol":"NagPack","correct":"from cdk_nag import NagPack"},{"symbol":"NIST80053R5Checks","correct":"from cdk_nag import NIST80053R5Checks"},{"symbol":"HIPAASecurityChecks","correct":"from cdk_nag import HIPAASecurityChecks"}],"quickstart":{"code":"import os\nfrom aws_cdk import App, Stack, Aspects, aws_s3 as s3\nfrom constructs import Construct\nfrom cdk_nag import AwsSolutionsChecks, NagSuppressions\n\nclass MyNaggedStack(Stack):\n    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:\n        super().__init__(scope, construct_id, **kwargs)\n\n        # An S3 bucket that will likely trigger some AwsSolutions nags\n        # for missing logging, encryption, and public access blocks.\n        my_bucket = s3.Bucket(self, \"MyInsecureBucket\")\n\n        # Suppress a specific finding on the bucket with a clear reason\n        # This suppression is for demonstration; always address findings first.\n        NagSuppressions.add_resource_suppressions(\n            my_bucket,\n            [\n                {\n                    \"id\": \"AwsSolutions-S1\",\n                    \"reason\": \"This is a demonstration bucket; access logging is not critical for this specific example.\"\n                }\n            ]\n        )\n\napp = App()\n\n# Apply AWS Solutions Checks to the entire app\nAspects.of(app).add(AwsSolutionsChecks(verbose=True))\n\nMyNaggedStack(app, \"CdkNagDemoStack\")\n\napp.synth()\n","lang":"python","description":"This quickstart demonstrates how to integrate `cdk-nag` into a Python CDK application. It creates a simple S3 bucket that would typically trigger AWS Solutions best practice warnings. It then shows how to apply the `AwsSolutionsChecks` to the entire application and how to add a suppression for a specific rule on a resource, including a mandatory reason for the suppression. Run `cdk synth` after adding this code to see the nag findings."},"warnings":[{"fix":"Ensure that only a single, consistent version of `aws-cdk-lib` is used across your entire monorepo. Workarounds like using `vite-node` for specific build steps have been reported.","message":"When using monorepos with package managers like PNPM, `cdk-nag` might fail to enforce rule checks silently if multiple versions of `aws-cdk-lib` are present. This occurs due to `instanceof` checks that evaluate to false across different instances of the `aws-cdk-lib` module.","severity":"gotcha","affected_versions":"Potentially all `cdk-nag` versions relying on `instanceof` checks for `aws-cdk-lib` constructs (e.g., 2.22.21 and later)."},{"fix":"Explicitly call `.buildPipeline()` on your `CodePipeline` object to force the pipeline construct creation forward, ensuring that all child constructs are available for aspect visitation.","message":"Constructs within `aws-cdk-lib/pipelines.CodePipeline` and its children are not always guaranteed to be 'Visited' by `cdk-nag` Aspects during the CDK lifecycle. This can lead to missed rule violations or ineffective suppressions on pipeline-related resources.","severity":"gotcha","affected_versions":"All versions where `aws-cdk-lib/pipelines` aspects are not consistently visited."},{"fix":"Always provide a detailed and meaningful `reason` when adding `NagSuppressions`. This documentation is crucial for future audits and understanding security decisions.","message":"Suppressing `cdk-nag` findings without a clear, valid reason can undermine security posture and compliance efforts. Each suppression should be a conscious decision, not a shortcut.","severity":"gotcha","affected_versions":"All versions."},{"fix":"Proactively configure AWS resources to adhere to security best practices (e.g., enable encryption, enforce SSL, configure logging) rather than relying on defaults. Use `cdk-nag` output to guide these improvements.","message":"Many AWS resources, when created with default CDK configurations, do not meet common security best practices (e.g., S3 buckets without server-side encryption or access logging, SNS topics without SSL enforcement). These defaults will often trigger `cdk-nag` warnings or errors.","severity":"gotcha","affected_versions":"All versions, as this relates to default CDK resource behavior."}],"env_vars":null,"search_vec":"'2.37.55':80 'activ':82 'applic':22 'aspect':40 'aw':14,49,89 'best':27,94 'bucket':65 'cadenc':88 'cdk':1,4,18,21,39,90 'cdk-nag':3 'check':20 'cloud':15 'code':37 'complianc':26,96 'construct':43 'current':77 'databas':72 'deploy':74 'develop':16 'dss':55 'function':30 'help':58 'hipaa':51 'iac':92 'iam':68 'identifi':59 'infrastructur':35 'issu':60 'kit':17 'leverag':38 'librari':11,57 'like':48 'lint':93 'linter':33 'maintain':83 'nag':2,5 'nist':52 'open':9 'open-sourc':8 'over':66 'pack':47 'pci':54 'permiss':67 'polici':69 'practic':28,95 'public':71 'regular':86 'releas':87 'rule':46 's3':64 'secur':24,91 'solut':50 'sourc':10 'unencrypt':63 'valid':42 'various':45 'version':79","created_at":"2026-04-11T01:27:38.955744+00:00","updated_at":"2026-04-16T14:23:04.780890+00:00","problems":[{"fix":"Refine the IAM policy to grant only necessary, specific permissions for actions and resources. Alternatively, add a cdk-nag suppression to the resource or stack, providing a clear justification for the wildcard use.","cause":"An AWS IAM policy defined within a CDK construct uses wildcard permissions (`*`) for actions or resources, which violates the AwsSolutions-IAM5 rule in cdk-nag, requiring least privilege.","error":"[Error at /MyStack/MyResource/Resource] AwsSolutions-IAM5: The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission."},{"fix":"Activate your Python virtual environment (if using one) and install the 'cdk-nag' package using pip: `pip install cdk-nag`.","cause":"The 'cdk-nag' Python package is not installed in the currently active Python environment, or the environment where it is installed is not active.","error":"ModuleNotFoundError: No module named 'cdk_nag'"},{"fix":"Ensure that only a single version of 'aws-cdk-lib' is present and used at runtime across your project, often achieved by configuring package manager deduplication or dependency resolution strategies (e.g., in `package.json` for npm/yarn or `vite.config.ts` for Vite-based projects).","cause":"In monorepo setups, particularly with package managers that can result in multiple instances of 'aws-cdk-lib' being loaded, cdk-nag's internal 'instanceof' checks for CDK constructs can fail, causing it to not enforce rules or report findings.","error":"cdk-nag won't throw errors when using 2 versions of aws-cdk-lib in project because of instanceof check"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"3.0.2","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/cdklabs/cdk-nag.git","docs":null,"changelog":null,"pypi":"https://pypi.org/project/cdk-nag/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["aws","devops","auth-security","testing"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-28","last_verified":"2026-08-28","next_check":"2026-07-28","install_tag":null}}