security-review: scan CDK synthesized templates, skip only asset bundles (A2) #9

Merged

amoussa1229 merged 1 commit from fix/checkov-surgical-cdk-exclusions into main

2026-06-17 21:07:54 +00:00

amoussa1229 commented

2026-06-17 21:06:30 +00:00

(Migrated from github.com)

Switches checkov from skipping all of cdk.out (which silenced real S3/IAM IaC findings on the synthesized deploy templates) to skipping only the cdk.out/asset.<hash>/ dependency bundles — the actual cause of the checkov stall / cfn-lint arg-list blowup on CDK repos.

--skip-path 'cdk\.out/asset\.' anchored to cdk.out so cdk.out/*.template.json is still scanned and a source file named asset.* isn't accidentally excluded.
cfn-lint + semgrep already prune these trees (prior commit); gitleaks runs git-mode (respects .gitignore), so no change there.

Verified: shellcheck clean; a synthetic cdk.out test confirms the stack template is scanned while asset.* is skipped; the orchestrator's own --scanners-only gate still exits 0 with suppressions; A1==A2 findings on this (non-CDK) repo (inert here, behavior only differs on CDK repos).

Note: this restores coverage, so CDK repos with a real S3-BPA/IAM gap will still (correctly) flag — the fix for those is the bucket-construct codification, not silencing the scanner.

Switches checkov from skipping all of `cdk.out` (which silenced real S3/IAM IaC findings on the synthesized deploy templates) to skipping **only** the `cdk.out/asset.<hash>/` dependency bundles — the actual cause of the checkov stall / `cfn-lint` arg-list blowup on CDK repos. - `--skip-path 'cdk\.out/asset\.'` anchored to `cdk.out` so `cdk.out/*.template.json` is still scanned and a source file named `asset.*` isn't accidentally excluded. - cfn-lint + semgrep already prune these trees (prior commit); gitleaks runs git-mode (respects `.gitignore`), so no change there. **Verified:** shellcheck clean; a synthetic `cdk.out` test confirms the stack template **is** scanned while `asset.*` is skipped; the orchestrator's own `--scanners-only` gate still exits 0 with suppressions; A1==A2 findings on this (non-CDK) repo (inert here, behavior only differs on CDK repos). Note: this restores coverage, so CDK repos with a real S3-BPA/IAM gap will still (correctly) flag — the fix for those is the bucket-construct codification, not silencing the scanner.

This repo is archived. You cannot comment on pull requests.

No reviewers