From b810de1743a0b96322fb3818eff0b08d4102bb82 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 23 Jul 2026 16:18:46 -0400 Subject: [PATCH] refactor(cdk): drop unreferenced ssm value parameters MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit fromStringParameterName injects an AWS::SSM::Parameter::Value CloudFormation parameter to carry the parameter's value, but DoorId and PhoneIps are only used for grantRead, which builds the ARN from the name string — so DoorIdParameter and PhoneIpsParameter sat unreferenced in the template (flagged W2001 by the CloudFormation validator newly bundled in aws-cdk-lib 2.262.0). Switching to fromStringParameterAttributes with forceDynamicReference resolves the value lazily via an SSM dynamic reference, emitting nothing when unused. Verified the synthesized template is identical apart from the removed Parameters entries and the CDKMetadata analytics hash — no IAM or resource changes. Also re-points the four line-keyed semgrep detect-child-process suppressions (adjudicated FPs, INFRA-105) to the shifted line numbers; the findings themselves are unchanged. Signed-off-by: Adam Moussa --- .security-review/suppressions.json | 20 ++++++++++---------- lib/door-unlock-stack.ts | 16 ++++++++++++---- 2 files changed, 22 insertions(+), 14 deletions(-) diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json index ed6bb5f..e0e6398 100644 --- a/.security-review/suppressions.json +++ b/.security-review/suppressions.json @@ -1,20 +1,20 @@ { "suppressions": [ { - "id": "semgrep-detect-child-process-55", - "justification": "False positive. CDK local-bundling tryBundle(outputDir) in lib/door-unlock-stack.ts. execSync runs esbuild at cdk-synth time; outputDir is supplied by the CDK framework (staging temp dir) and the other path segments are repo-relative constants. No untrusted input, build-time only on a trusted host, never runs at request time. Verified proof-or-kill 2026-07-13. INFRA-105." + "id": "semgrep-detect-child-process-61", + "justification": "False positive. CDK local-bundling tryBundle(outputDir) in lib/door-unlock-stack.ts. execSync runs esbuild at cdk-synth time; outputDir is supplied by the CDK framework (staging temp dir) and the other path segments are repo-relative constants. No untrusted input, build-time only on a trusted host, never runs at request time. Verified proof-or-kill 2026-07-13. INFRA-105. Re-pointed from line 55 on 2026-07-23: fromStringParameterName cleanup shifted lines in lib/door-unlock-stack.ts; finding unchanged." }, { - "id": "semgrep-detect-child-process-84", - "justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105." + "id": "semgrep-detect-child-process-90", + "justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105. Re-pointed from line 84 on 2026-07-23: fromStringParameterName cleanup shifted lines in lib/door-unlock-stack.ts; finding unchanged." }, { - "id": "semgrep-detect-child-process-122", - "justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105." + "id": "semgrep-detect-child-process-128", + "justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105. Re-pointed from line 122 on 2026-07-23: fromStringParameterName cleanup shifted lines in lib/door-unlock-stack.ts; finding unchanged." }, { - "id": "semgrep-detect-child-process-202", - "justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105." + "id": "semgrep-detect-child-process-210", + "justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105. Re-pointed from line 202 on 2026-07-23: fromStringParameterName cleanup shifted lines in lib/door-unlock-stack.ts; finding unchanged." }, { "id": "checkov-CKV_AWS_111-234", @@ -22,7 +22,7 @@ }, { "id": "gitleaks-generic-api-key-5193", - "justification": "False positive. A provisioning-template token placeholder (the literal __DOOR_UNLOCK_TOKEN__) in Yealink T54W templates — not a secret. The real token was rotated in SSM (INFRA-105, param v3 2026-07-06) and the historical live token was removed by the git-filter-repo history scrub; only the placeholder remains." + "justification": "False positive. A provisioning-template token placeholder (the literal __DOOR_UNLOCK_TOKEN__) in Yealink T54W templates \u2014 not a secret. The real token was rotated in SSM (INFRA-105, param v3 2026-07-06) and the historical live token was removed by the git-filter-repo history scrub; only the placeholder remains." }, { "id": "gitleaks-generic-api-key-900", @@ -30,7 +30,7 @@ }, { "id": "gitleaks-generic-api-key-3097", - "justification": "False positive. A __DOOR_UNLOCK_TOKEN__ placeholder in a Yealink provisioning template (unlock linekey) — not a secret. Live token rotated in SSM 2026-07-06; history scrubbed via git-filter-repo (INFRA-105)." + "justification": "False positive. A __DOOR_UNLOCK_TOKEN__ placeholder in a Yealink provisioning template (unlock linekey) \u2014 not a secret. Live token rotated in SSM 2026-07-06; history scrubbed via git-filter-repo (INFRA-105)." } ] } diff --git a/lib/door-unlock-stack.ts b/lib/door-unlock-stack.ts index 269033a..e8b0efa 100644 --- a/lib/door-unlock-stack.ts +++ b/lib/door-unlock-stack.ts @@ -34,10 +34,16 @@ export class DoorUnlockStack extends cdk.Stack { { parameterName: "/seahaven/door-unlock/auth-token" } ); - const doorIdParam = ssm.StringParameter.fromStringParameterName( + // forceDynamicReference: the stack only needs the parameter for grantRead + // (ARN, built from the name); without it, fromStringParameterName injects + // an unreferenced AWS::SSM::Parameter::Value CloudFormation parameter. + const doorIdParam = ssm.StringParameter.fromStringParameterAttributes( this, "DoorId", - "/seahaven/door-unlock/door-id" + { + parameterName: "/seahaven/door-unlock/door-id", + forceDynamicReference: true, + } ); const unlockHandler = new lambda.Function(this, "UnlockHandler", { @@ -179,8 +185,10 @@ export class DoorUnlockStack extends cdk.Stack { ec2.Peer.ipv4("10.10.0.0/16"), ec2.Port.tcp(443), "HTTPS to phone LAN via VPN" ); - const phoneIpsParam = ssm.StringParameter.fromStringParameterName( - this, "PhoneIps", "/seahaven/door-unlock/phone-ips" + // forceDynamicReference for the same reason as DoorId above. + const phoneIpsParam = ssm.StringParameter.fromStringParameterAttributes( + this, "PhoneIps", + { parameterName: "/seahaven/door-unlock/phone-ips", forceDynamicReference: true } ); const phonePasswordSecret = secretsmanager.Secret.fromSecretNameV2(