adam/security-review
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/security-review.git synced 2026-10-04 14:52:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(scanner): skip gitignored cdk.out synth output in checkov scan (INFRA-144) (#3)

Browse source 
checkov scanned cdk.out/<stack>.template.json, which is gitignored generated
synth output. A dev with a stale cdk.out lying around would false-block unrelated
pushes on CKV_AWS_111 raised against CDK-generated roles (LogRetention, asset
publishing) that are not authored source. Broaden the checkov --skip-path from
cdk.out/asset. to the whole cdk.out/ tree so it treats synth output the same as
semgrep (--exclude cdk.out) and cfn-lint (cdk.out prune) already do.

Authored IaC checkov parses (SAM/CFN template.yaml, Terraform) is tracked source
and is still fully scanned; verified a planted wildcard IAM policy in tracked
source still trips CKV_AWS_111 and blocks.
This commit is contained in:
Adam Moussa 2026-07-08 16:54:01 -04:00 • committed by GitHub
parent 643c6139da
commit 9cac679bc3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
review.sh
View file

@ -121,12 +121,17 @@ else note_missing gitleaks "brew install gitleaks"; fi
if command -v checkov >/dev/null; then if command -v checkov >/dev/null; then
CKALL="$TMP/ck.json"; echo '[]' > "$CKALL" CKALL="$TMP/ck.json"; echo '[]' > "$CKALL"
for p in $SCOPE_PATHS; do for p in $SCOPE_PATHS; do
# --skip-path is a regex over the file path. Skip only the cdk.out asset.<hash>/ # --skip-path is a regex over the file path. Skip the ENTIRE cdk.out/ synth tree
# dependency bundles (the stall cause) + vendored/generated dirs — but KEEP # plus other generated/vendored dirs. cdk.out/ is gitignored generated output, not
# scanning cdk.out/<stack>.template.json, which is the real deploy artifact # source — gating pushes on it false-blocks unrelated work (INFRA-144): checkov
# (dropping it would silence genuine S3/IAM IaC findings). asset is anchored to # raises CKV_AWS_111 (and similar) on CDK-generated roles (LogRetention, asset
# cdk.out so a source file literally named asset.* is not also excluded. # publishing, bootstrap) that only exist post-synth and that a dev may have lying
if [ -d "$p" ]; then RAW="$(checkov -d "$p" --skip-path 'cdk\.out/asset\.' --skip-path node_modules --skip-path '\.claude' --skip-path '\.venv' --skip-path venv --skip-path '\.aws-sam' --skip-path dist --skip-path build -o json --compact --quiet 2>/dev/null || true)" # around from a stale `cdk synth`. Authored IaC that checkov actually parses
# (SAM/CFN template.yaml, Terraform) is TRACKED source and is still fully scanned;
# CDK synth output is covered by the agentic /sh-security-review pass, not this
# deterministic gate. Matches semgrep's `--exclude cdk.out` and cfn-lint's cdk.out
# prune, so all three scanners now treat synth output consistently.
if [ -d "$p" ]; then RAW="$(checkov -d "$p" --skip-path 'cdk\.out/' --skip-path node_modules --skip-path '\.claude' --skip-path '\.venv' --skip-path venv --skip-path '\.aws-sam' --skip-path dist --skip-path build -o json --compact --quiet 2>/dev/null || true)"
else RAW="$(checkov -f "$p" -o json --compact --quiet 2>/dev/null || true)"; fi else RAW="$(checkov -f "$p" -o json --compact --quiet 2>/dev/null || true)"; fi
[ -z "$RAW" ] && continue [ -z "$RAW" ] && continue
FC="$(echo "$RAW" | jq '[ (if type=="array" then .[] else . end).results.failed_checks // [] ] | add // []' 2>/dev/null || echo '[]')" FC="$(echo "$RAW" | jq '[ (if type=="array" then .[] else . end).results.failed_checks // [] ] | add // []' 2>/dev/null || echo '[]')"