feat: CDK re-write --DO NOT MERGE-- #328

rafaelpereyra · 2025-07-30T15:53:51Z

Added pre-commit hooks and other validation tools for this process

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Added pre-commit hooks and other validation tools for this process

github-actions · 2025-07-30T15:54:59Z

ASH Security Scan Report

Report generated: 2025-11-11T14:13:39+00:00
Time since scan: 1 minute

Scan Metadata

Project: ASH
Scan executed: 2025-11-11T14:12:21+00:00
ASH version: 3.1.2

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

Severity levels:
- Suppressed (S): Findings that have been explicitly suppressed and don't affect scanner status
- Critical (C): Highest severity findings that require immediate attention
- High (H): Serious findings that should be addressed soon
- Medium (M): Moderate risk findings
- Low (L): Lower risk findings
- Info (I): Informational findings with minimal risk
Duration (Time): Time taken by the scanner to complete its execution
Actionable: Number of findings at or above the threshold severity level that require attention
Result:
- PASSED = No findings at or above threshold
- FAILED = Findings at or above threshold
- MISSING = Required dependencies not available
- SKIPPED = Scanner explicitly disabled
- ERROR = Scanner execution error
Threshold: The minimum severity level that will cause a scanner to fail
- Thresholds: ALL, LOW, MEDIUM, HIGH, CRITICAL
- Source: Values in parentheses indicate where the threshold is set:
  - global (global_settings section in the ASH_CONFIG used)
  - config (scanner config section in the ASH_CONFIG used)
  - scanner (default configuration in the plugin, if explicitly set)
Statistics calculation:
- All statistics are calculated from the final aggregated SARIF report
- Suppressed findings are counted separately and do not contribute to actionable findings
- Scanner status is determined by comparing actionable findings to the threshold

Scanner	Suppressed	Critical	Medium	Low	Actionable	Result	Threshold
bandit	0	0	0	20	0	PASSED	MEDIUM (global)
cdk-nag	0	0	0	0	0	SKIPPED	MEDIUM (global)
cfn-nag	0	0	0	0	0	MISSING	MEDIUM (global)
checkov	28	15	0	0	15	SKIPPED	MEDIUM (global)
detect-secrets	0	0	0	0	0	SKIPPED	MEDIUM (global)
grype	0	0	1	1	1	FAILED	MEDIUM (global)
npm-audit	0	0	0	0	0	PASSED	MEDIUM (global)
opengrep	0	0	0	0	0	MISSING	MEDIUM (global)
semgrep	0	39	0	0	39	FAILED	MEDIUM (global)
syft	0	0	0	0	0	PASSED	MEDIUM (global)
trivy-repo	0	0	0	0	0	MISSING	MEDIUM (global)

Top 10 Hotspots

Files with the highest number of security findings:

Finding Count	File Location
7	src/applications/microservices/petsearch-java/docker-compose.yml
6	src/applications/lambda/petfood-cleanup-processor-node/index.js
4	src/applications/microservices/payforadoption-go/benchmark/Dockerfile
4	src/applications/lambda/traffic-generator-node/index.js
4	src/applications/microservices/petlistadoptions-py/docker-compose.yml
3	src/applications/microservices/petsite-net/petsite/Dockerfile
3	src/applications/microservices/payforadoption-go/Dockerfile
2	src/applications/microservices/petsearch-java/Dockerfile
2	src/applications/microservices/petlistadoptions-py/Dockerfile
2	src/applications/lambda/petfood-stock-processor-node/index.js

Detailed Findings

Show 20 of 55 actionable findings

Finding 1: CKV_AWS_111

Severity: HIGH
Scanner: checkov
Rule ID: CKV_AWS_111
Location: src/templates/codebuild-deployment-template.yaml:1458-1481

Description:
Ensure IAM policies does not allow write access without constraints

Code Snippet:

rCrossRegionStackOperationRole:
    Type: AWS::IAM::Role
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: CrossRegionStackOperationPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:DeleteStack
                Resource: "*"

Finding 2: CKV_DOCKER_2

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_2
Location: src/applications/microservices/petsearch-java/Dockerfile:1-24

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM --platform=$BUILDPLATFORM public.ecr.aws/docker/library/gradle:7.3-jdk17 as build

WORKDIR /app
COPY ./build.gradle ./build.gradle
COPY ./src ./src
COPY ./settings.gradle ./settings.gradle

ENV GRADLE_OPTS "-Dorg.gradle.daemon=false"
RUN gradle build -DexcludeTags='integration' --no-daemon --stacktrace

FROM public.ecr.aws/amazoncorretto/amazoncorretto:17-al2-generic-jdk
WORKDIR /app

RUN yum install -y curl unzip && \
    curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    unzip awscliv2.zip && \
    ./aws/install && \
    rm -rf awscliv2.zip aws && \
    yum clean all

ARG JAR_FILE=build/libs/\*.jar
COPY --from=build /app/${JAR_FILE} ./app.jar

ENTRYPOINT ["java","-jar","/app/app.jar"]

Finding 3: CKV_DOCKER_3

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_3
Location: src/applications/microservices/petsearch-java/Dockerfile:1-24

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM --platform=$BUILDPLATFORM public.ecr.aws/docker/library/gradle:7.3-jdk17 as build

WORKDIR /app
COPY ./build.gradle ./build.gradle
COPY ./src ./src
COPY ./settings.gradle ./settings.gradle

ENV GRADLE_OPTS "-Dorg.gradle.daemon=false"
RUN gradle build -DexcludeTags='integration' --no-daemon --stacktrace

FROM public.ecr.aws/amazoncorretto/amazoncorretto:17-al2-generic-jdk
WORKDIR /app

RUN yum install -y curl unzip && \
    curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    unzip awscliv2.zip && \
    ./aws/install && \
    rm -rf awscliv2.zip aws && \
    yum clean all

ARG JAR_FILE=build/libs/\*.jar
COPY --from=build /app/${JAR_FILE} ./app.jar

ENTRYPOINT ["java","-jar","/app/app.jar"]

Finding 4: CKV_DOCKER_2

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_2
Location: src/applications/microservices/petsite-net/petsite/Dockerfile:1-22

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY *.csproj .
RUN dotnet restore "PetSite.csproj" --no-cache
COPY . .
RUN dotnet publish "PetSite.csproj" -c Release -o /app/publish

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final
WORKDIR /app
EXPOSE 80
ENV ASPNETCORE_HTTP_PORTS=80
# Install AWS CLI and curl for troubleshooting
RUN apt-get update && apt-get install -y curl unzip && \
    curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    unzip awscliv2.zip && \
    ./aws/install && \
    rm -rf awscliv2.zip aws && \
    apt-get remove -y unzip && \
    apt-get autoremove -y && \
    rm -rf /var/lib/apt/lists/*
COPY --from=build /app/publish .
ENTRYPOINT ["dotnet", "PetSite.dll"]

Finding 5: CKV_DOCKER_3

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_3
Location: src/applications/microservices/petsite-net/petsite/Dockerfile:1-22

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY *.csproj .
RUN dotnet restore "PetSite.csproj" --no-cache
COPY . .
RUN dotnet publish "PetSite.csproj" -c Release -o /app/publish

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final
WORKDIR /app
EXPOSE 80
ENV ASPNETCORE_HTTP_PORTS=80
# Install AWS CLI and curl for troubleshooting
RUN apt-get update && apt-get install -y curl unzip && \
    curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    unzip awscliv2.zip && \
    ./aws/install && \
    rm -rf awscliv2.zip aws && \
    apt-get remove -y unzip && \
    apt-get autoremove -y && \
    rm -rf /var/lib/apt/lists/*
COPY --from=build /app/publish .
ENTRYPOINT ["dotnet", "PetSite.dll"]

Finding 6: CKV_DOCKER_2

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_2
Location: src/applications/microservices/petfood-rs/Dockerfile:1-32

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

# Build stage
FROM public.ecr.aws/docker/library/rust:bookworm AS builder
COPY . .
RUN cargo build --release

# Runtime stage
FROM public.ecr.aws/docker/library/debian:bookworm-slim

# Install runtime dependencies and CA certificates
RUN apt-get update && apt-get install -y \
    ca-certificates \
    openssl \
    curl \
    unzip \
    && curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" \
    && unzip awscliv2.zip \
    && ./aws/install \
    && rm -rf awscliv2.zip aws \
    && apt-get remove -y unzip \
    && apt-get autoremove -y \
    && rm -rf /var/lib/apt/lists/* \
    && update-ca-certificates

COPY --from=builder /target/release/petfood-rs /app/petfood-rs

# Create a non-root user for security
RUN useradd -r -s /bin/false petfood && \
    chown petfood:petfood /app/petfood-rs

USER petfood
EXPOSE 8080
CMD ["/app/petfood-rs"]

Finding 7: CKV_DOCKER_2

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_2
Location: src/applications/microservices/payforadoption-go/Dockerfile:1-14

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM public.ecr.aws/docker/library/golang:1.24 as builder
WORKDIR /go/src/app
COPY . .
ENV GOPROXY=https://goproxy.io,direct
RUN go get .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .

FROM public.ecr.aws/docker/library/alpine:3.22.1
WORKDIR /app
RUN apk --no-cache add ca-certificates curl aws-cli
COPY --from=builder /go/src/app/app .
COPY --from=builder /go/src/app/seed.json .
EXPOSE 80
CMD ["./app"]

Finding 8: CKV_DOCKER_3

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_3
Location: src/applications/microservices/payforadoption-go/Dockerfile:1-14

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM public.ecr.aws/docker/library/golang:1.24 as builder
WORKDIR /go/src/app
COPY . .
ENV GOPROXY=https://goproxy.io,direct
RUN go get .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .

FROM public.ecr.aws/docker/library/alpine:3.22.1
WORKDIR /app
RUN apk --no-cache add ca-certificates curl aws-cli
COPY --from=builder /go/src/app/app .
COPY --from=builder /go/src/app/seed.json .
EXPOSE 80
CMD ["./app"]

Finding 9: CKV_DOCKER_2

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_2
Location: src/applications/microservices/petfoodagent-strands-py/Dockerfile:1-40

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
WORKDIR /app

# Configure UV for container environment
ENV UV_SYSTEM_PYTHON=1 UV_COMPILE_BYTECODE=1



COPY requirements.txt requirements.txt
# Install from requirements file
RUN uv pip install -r requirements.txt




RUN uv pip install aws-opentelemetry-distro>=0.10.1


# Set AWS region environment variable

ENV AWS_REGION=us-east-1
ENV AWS_DEFAULT_REGION=us-east-1


# Signal that this is running in Docker for host binding logic
ENV DOCKER_CONTAINER=1

# Create non-root user
RUN useradd -m -u 1000 bedrock_agentcore
USER bedrock_agentcore

EXPOSE 8080
EXPOSE 8000

# Copy entire project (respecting .dockerignore)
COPY . .

# Use the full module path

CMD ["opentelemetry-instrument", "python", "-m", "agent"]

Finding 10: CKV_DOCKER_3

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_3
Location: src/applications/microservices/petlistadoptions-py/Dockerfile:1-52

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM public.ecr.aws/docker/library/python:3.11-slim as builder

WORKDIR /app

# Install system dependencies
RUN apt-get update && apt-get install -y \
    gcc \
    libpq-dev \
    && rm -rf /var/lib/apt/lists/*

#

# Copy requirements and install Python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
RUN pip install awscli

# Copy application code
COPY . .

# Production stage
FROM public.ecr.aws/docker/library/python:3.11-slim

WORKDIR /app

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
    libpq5 \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Copy Python packages from builder
COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

# Copy application code
COPY --from=builder /app .

# Make start script executable
RUN chmod +x start.sh

# Create non-root user for future use (but run as root for port 80 access)
RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app

# Add health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:80/health/status || exit 1

EXPOSE 80

# Use startup script (running as root for port 80 access)
CMD ["./start.sh"]

Finding 11: CKV_DOCKER_7

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_7
Location: src/applications/microservices/payforadoption-go/benchmark/Dockerfile:1

Description:
Ensure the base image uses a non latest version tag

Code Snippet:

FROM public.ecr.aws/docker/library/rust:latest:latest as builder

Finding 12: CKV_DOCKER_2

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_2
Location: src/applications/microservices/payforadoption-go/benchmark/Dockerfile:1-6

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM public.ecr.aws/docker/library/rust:latest:latest as builder
WORKDIR /app
RUN
COPY . .
RUN cargo install drill
CMD ["./benchmark.sh"]

Finding 13: CKV_DOCKER_3

Severity: HIGH
Scanner: checkov
Rule ID: CKV_DOCKER_3
Location: src/applications/microservices/payforadoption-go/benchmark/Dockerfile:1-6

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM public.ecr.aws/docker/library/rust:latest:latest as builder
WORKDIR /app
RUN
COPY . .
RUN cargo install drill
CMD ["./benchmark.sh"]

Finding 14: CKV2_GHA_1

Severity: HIGH
Scanner: checkov
Rule ID: CKV2_GHA_1
Location: .github/workflows/tests.yml:1

Description:
Ensure top-level permissions are not set to write-all

Finding 15: CKV2_GHA_1

Severity: HIGH
Scanner: checkov
Rule ID: CKV2_GHA_1
Location: .github/workflows/pre-commit.yml:1

Description:
Ensure top-level permissions are not set to write-all

Finding 16: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
Location: src/applications/lambda/petfood-cleanup-processor-node/index.js:61

Description:
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.

Code Snippet:

console.error(`Failed to delete S3 object s3://${bucket}/${key}:`, error.message);

Finding 17: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
Location: src/applications/lambda/petfood-cleanup-processor-node/index.js:82

Description:
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.

Code Snippet:

console.error(`Failed to delete DynamoDB record for food ${foodId}:`, error.message);

Finding 18: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
Location: src/applications/lambda/petfood-cleanup-processor-node/index.js:108

Description:
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.

Code Snippet:

console.log(`Attempt ${attempt} failed, retrying in ${delay}ms:`, error.message);

Finding 19: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
Location: src/applications/lambda/petfood-cleanup-processor-node/index.js:133

Description:
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.

Code Snippet:

console.log(`Processing cleanup event for food ${eventData.foodId}`, {

Finding 20: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Severity: HIGH
Scanner: semgrep
Rule ID: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
Location: src/applications/lambda/petfood-cleanup-processor-node/index.js:182

Description:
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.

Code Snippet:

`Cleanup processing completed successfully for food ${eventData.foodId}`,

Note: Showing 20 of 55 total actionable findings. Configure max_detailed_findings to adjust this limit.

Report generated by Automated Security Helper (ASH) at 2025-11-11T14:13:39+00:00

… new code

added PipelineArn output so initial Codebuild can succeed

…to CodeBuildStep - Remove CONFIG_BUCKET_KEY environment variable and replace with dynamic S3 key path construction - Add WORKING_FOLDER environment variable for configurable working directory - Update CDKPipeline interface to use workingFolder instead of configBucketKey - Replace ShellStep with CodeBuildStep for synthesis with Node.js 22.x runtime - Add proper build environment configuration and CodeBuild defaults - Grant read permissions to config bucket for pipeline role

- Add Lambda execution role with S3 permissions for bucket cleanup - Add Lambda function to empty S3 bucket on stack deletion - Add custom resource to trigger bucket cleanup during CloudFormation deletion - Change S3 bucket versioning from Enabled to Suspended - Update .gitignore to exclude .ash/ash_output directory

Changed CDK pipeline stack name from 'CDKPipeline' to 'OneObservabilityWorkshopPipeline' in workshop.ts

…s character - Fixed S3 bucket policy resource reference in codebuild-deployment-template.yaml by correcting the order of bucket ARN references - Removed erroneous 'q' character from buildspec command in the same template file

- Rename bucket cleanup components to generic resource cleanup functionality - Extend cleanup to handle EventBridge rules and Lambda permissions - Migrate Lambda functions from Node.js 22.x to Python 3.13 runtime - Replace static EventBridge rule with dynamic rule creation during build - Update IAM policies for EventBridge and Lambda cleanup permissions - Fix S3 resource ARN reference format - Remove static resources in favor of dynamic creation approach

Reformatted CloudFormation template YAML syntax by converting quoted strings to unquoted format, changing description block style from folded to literal, expanding inline conditional statements to multi-line format, and adding explicit function name to Lambda resource to prevent circular dependency.

- Add docs/ folder with README, CHANGELOG, and detailed template documentation - Add architecture and deployment flow diagrams (PNG files) - Add template documentation with implementation details, retry handling, and troubleshooting - Add templates folder README with quick start guide - Add new simplified CodeBuild deployment template with intelligent retry handling - Enhance IAM permissions in original template with S3 bucket access policies and CFN-NAG suppressions

* fix: improve CloudFormation signaling in CDK deployment template - Add explicit SUCCESS signal when pipeline monitoring detects completion - Prevent duplicate signaling in final success handling - Enhance logging for better visibility of signaling events * fix: replace CloudFormation signal-resource with direct wait handle URL calls Modified CloudFormation wait condition signaling mechanism in CodeBuild deployment template. Replaced direct aws cloudformation signal-resource commands with curl-based HTTP PUT requests to wait condition handle URLs. Changes include: - Retrieving wait condition handle URL using describe-stack-resource command - Using curl to send SUCCESS/FAILURE signals with JSON payload containing status, reason, unique ID, and data fields - Applied to both success and failure signaling paths in the deployment process * feat: add core infrastructure stage with enhanced configuration - Enhanced environment configuration with comprehensive documentation and type definitions - Added core infrastructure stage with VPC creation and networking setup - Improved pipeline structure with stage sequencing and tagging support - Updated CDK-nag suppressions for better compliance handling - Added comprehensive JSDoc documentation across all modified files - Restructured application entry point with better configuration management * feat: add CloudTrail construct with CloudWatch integration - Added CloudTrail construct with CloudWatch logs integration and anomaly detection (92 lines) - Updated environment configuration with CloudTrail integration (8 lines) - Enhanced workshop configuration with CloudTrail support (2 lines) - Updated main index with CloudTrail exports (1 line) - Modified pipeline configuration for CloudTrail deployment (2 lines) - Extended core stage with CloudTrail trail setup (15 lines) --------- Co-authored-by: Rafael Pereyra <[email protected]>

- Add explicit SUCCESS signal when pipeline monitoring detects completion - Prevent duplicate signaling in final success handling - Enhance logging for better visibility of signaling events

* refactor: improve CloudTrail construct configuration - Remove unused imports (DataResourceType, ReadWriteType) - Add includeLambdaEvents property to interface - Remove unused cloudTrailRole variable assignment - Replace custom S3 event selector with logAllS3DataEvents() method - Add Lambda data events logging when includeLambdaEvents is enabled * fix: improve pipeline retry logic in codebuild template - Added RETRY_LOOP_COUNT and MAX_RETRY_LOOPS variables for better retry tracking - Enhanced retry mechanism to distinguish between execution retries and loop retries - Reset retry loop counter when new pipeline execution is detected - Updated error messages to reflect the new retry loop logic - Changed maximum retry logic to use retry loops instead of execution count * feat: enhance logging capabilities for CloudTrail and VPC networking - Add unique resource naming for CloudTrail log groups to prevent conflicts - Implement configurable VPC Flow Logs with comprehensive log format - Add DNS Query Resolver Logs functionality for VPC - Enable optional log retention configuration across constructs - Update Core stack to enable logging features by default * fix: correct core stage tags structure in CDK pipeline Modified the core stage properties handling to properly wrap tags in a tags property instead of spreading them directly into the properties object. This ensures proper tag structure for the CoreStage constructor. * feat: add local development setup and enhance contributing guidelines - Added Apache-2.0 license header to CONTRIBUTING.md - Enhanced CONTRIBUTING.md with comprehensive documentation for security scanning, pre-commit hooks, and local development setup - Added new local CDK application entry point (src/cdk/bin/local.ts) for faster development workflow --------- Co-authored-by: Rafael Pereyra <[email protected]>

…nt tooling - Updated CONTRIBUTING.md with additional content (22 lines added) - Added new environment sample file (.env.sample) with 9 lines - Enhanced environment.ts configuration with 45 new lines - Extended local.ts deployment script with additional functionality - Added CloudTrail construct enhancements (12 lines) - Minor updates to network construct (2 lines) - Updated pipeline configuration (5 lines modified) - Created new applications stage with comprehensive setup (150 lines) - Added deployment check script with validation logic (66 lines)

* feat: integrate applications pipeline stage with CDK pipeline - Add APPLICATION_LIST import and configuration to workshop.ts - Enhance CDKPipeline with applicationList property and ApplicationsPipelineStage - Extract bucket key configuration to variable for reusability - Add comprehensive documentation and type definitions to applications.ts - Integrate Applications stage into main pipeline with proper tagging and source configuration * refactor: organize pipeline stages into Core wave Modified pipeline.ts to organize deployment stages into a wave structure. Added a 'Core' wave and moved both the Core stage and Applications stage into this wave for better deployment organization and sequencing. * docs: standardize JSDoc parameter names and configure TypeDoc - Update constructor parameter documentation from 'props' to 'properties' in CloudTrail and Network constructs - Add dedicated TypeDoc configuration for CDK documentation generation - Update root TypeDoc configuration to reference CDK entry point and README * feat: add RemovalPolicy.DESTROY to CloudTrail LogGroup Modified CloudTrail construct to add RemovalPolicy.DESTROY to the CloudWatch Logs LogGroup and imported RemovalPolicy from aws-cdk-lib. --------- Co-authored-by: Rafael Pereyra <[email protected]>

* From Aurora serverless to Instance (#327) * Switch from serverless v2 to instances * Bump aurora version * Ignore editor settings * Add action for CDK tests * Export reader endpoint * Update tests * Remove unit, merge lint and synth * Skip docker builds on unrelated changes * Update petlist to use aurora reader endpoint * Bump versions * Bump CDK version * feat: add comprehensive infrastructure constructs and deployment stages - Modified environment configuration files (environment.ts, local.ts, workshop.ts) to add new deployment configurations - Added new construct files for assets, database, DynamoDB, and queue infrastructure components - Enhanced network construct with additional networking capabilities - Updated pipeline configuration with new stages and deployment logic - Added new compute stage for application deployment - Renamed applications.ts to containers.ts with updated container deployment logic - Added new storage stage for data persistence infrastructure - Total: 643 additions, 24 deletions across 12 files * feat: upgrade container images and database version - Update all Dockerfiles to use AWS ECR Public Gallery base images - Upgrade Aurora PostgreSQL from v13.20 to v16.8 - Update pre-commit hook versions (mypy v1.17.1, cfn-python-lint v1.38.2, ASH v3.0.0) - Enhance database construct with configurable instance types and CDK NAG suppressions - Add utility functions for CDK infrastructure - Improve deployment check script with enhanced validation * build: update Python base image to ECR public registry Modified PetAdoptions/petadoptionshistory-py/Dockerfile to update the base Python image from python:3.8 to public.ecr.aws/docker/library/python:3.8.20-bullseye. * feat: add compute infrastructure with ECS and EKS support - Add ECS cluster construct with auto scaling group and security group - Add EKS cluster construct with managed node groups and add-ons - Create microservice base class and ECS service implementation - Add pay-for-adoption microservice with database integration - Enhance network construct to disable public IP mapping - Update queue construct with CloudFormation exports for resource sharing - Add compute stage to pipeline with ECS and EKS deployment - Include kubectl v33 layer dependency for EKS operations - Add applications stage structure for microservices deployment * feat: add serverless microservices and enhance CDK infrastructure - Add new Lambda construct for serverless functions - Create serverless status-updater construct - Add new microservices: list-adoptions, pet-search, and traffic-generator - Enhance pay-for-adoption microservice with additional features - Update database and DynamoDB constructs with expanded functionality - Refactor ECS service construct with improved configuration - Enhance microservice construct with expanded capabilities - Significantly expand applications stage with new service integrations - Update environment and local configuration with enhanced setup - Add utility functions for improved helper capabilities * feat: add VPC endpoints and enhance API Gateway security - Add VPC endpoints construct for API Gateway, DynamoDB, and Lambda services - Configure status updater API Gateway as private endpoint with VPC endpoint policy - Add request authorizer and access logging to API Gateway - Include CDK NAG suppressions for security compliance - Export VPC endpoint IDs for cross-stack references - Integrate VPC endpoints into network construct and applications stack * feat: add EKS support and petsite microservice - Added new constants file and EKS deployment construct for better configuration management - Created new petsite microservice with Kubernetes deployment manifest - Enhanced EKS construct with additional deployment capabilities - Updated microservice construct to support both ECS and EKS deployments - Modified application stage to integrate new petsite service - Updated development configuration with new VS Code launch settings - Refined utility functions and updated project dependencies - Updated pre-commit configuration and prettier ignore rules * docs: add comprehensive architecture documentation and diagrams - Add detailed architecture.md covering system overview, deployment stages, microservices architecture, and observability components - Add 16 architectural diagrams illustrating complete system architecture, deployment stages, microservices structure, and observability setup - Update CDK constructs and microservices with minor code improvements and configuration adjustments * feat: enhance observability demo with service discovery and configuration management - Add CloudMap namespace support for ECS service discovery - Implement SSM parameter outputs for assets, database, and DynamoDB - Enhance ECS service construct to support load balancer-less services - Add VPC endpoints for ServiceDiscovery with improved networking - Update microservice configurations with service discovery integration - Improve database construct with separate reader/writer endpoint outputs - Add EKS kubectl lambda role export for enhanced cluster management - Update Kubernetes manifests and application stage configurations * feat: add microservices stage and standardize resource tagging - Add standardized tagging to all microservice classes with app:owner, app:project, app:name, app:computType, and app:hostType tags - Add MicroservicesStage to CDK pipeline with proper stage sequencing and tagging - Move QueueResources from StorageStack to CoreStack for better architectural organization - Update pipeline interface to include microservicesProperties parameter - Add missing Utilities import in traffic-generator.ts * feat: add microservices configuration to CDK pipeline Added microservices configuration to CDK pipeline by importing MICROSERVICES_PLACEMENT and LAMBDA_FUNCTIONS from environment and passing them as microservicesProperties to the CDKPipeline constructor. * feat: update CDK infrastructure and dependencies - Updated CDK TypeScript files across bin, lib/constructs, lib/stages, and lib/utils directories - Modified package.json and package-lock.json with dependency updates - Total: 8 files changed, 252 insertions, 272 deletions * refactor: simplify deployment template architecture - Remove EventBridge-based pipeline monitoring system - Replace Lambda functions with direct CodePipeline status polling - Eliminate complex event-driven architecture for simpler inline monitoring - Remove codebuild-deployment-template-simplified.yaml file - Update documentation and container configurations - Streamline deployment process with reduced complexity * fix: improve logging permissions and autoscaling group tagging - Update pipeline log ARN to use wildcard pattern for broader log group access - Simplify CloudWatch logs policy resources configuration - Add PropagateAtLaunch support for AutoScaling Group tags - Improve code formatting in utilities * docs: add comprehensive JSDoc documentation to CDK infrastructure - Added module-level documentation with package descriptions for all 6 files - Enhanced interface and class documentation with detailed parameter descriptions - Documented enums, constants, and configuration objects throughout - Added inline comments for improved code readability - Improved constructor and method documentation with parameter and return types * docs: restructure documentation and add automated generation - Added GitHub Actions workflow for documentation generation - Updated .gitignore to exclude documentation build artifacts - Updated pre-commit configuration - Moved CHANGELOG.md from docs/ to root directory - Removed diagram documentation and PNG files from docs/diagrams/ - Added new modules documentation file - Enhanced list-adoptions microservice with improved error handling - Updated containers stage with additional configuration - Enhanced TypeDoc configuration files with better documentation settings --------- Co-authored-by: Rodrigue Koffi <[email protected]> Co-authored-by: Rafael Pereyra <[email protected]>

Added instrumentation.opentelemetry.io/inject-dotnet annotation to enable automatic .NET instrumentation injection for the petsite deployment.

- Update all path references from PetAdoptions/cdk/pet_stack/ to src/cdk/ - Update cache paths and working directories to match new structure - Add environment file setup step to copy .env.example to .env before CDK synth - Maintain all existing workflow functionality with updated paths

- Extended build-test.yml and cdk-test.yml workflows to trigger on both main and staging branches - Refactored docs.yml workflow to separate build and deploy jobs, with deployment only occurring on main branch pushes - Added conditional logic to prevent staging branch changes from deploying to GitHub Pages

Move environment file copy operation from CDK synth step to separate earlier step for better workflow organization

bonclay7 · 2025-10-25T17:06:12Z

src/cdk/scripts/manage-exports.py

+        internal_prefixes = ["AWS::", "CDK::", "cdk-", "CdkBootstrap", "StagingBucket"]
+        return any(export_name.startswith(prefix) for prefix in internal_prefixes)
+
+    def _categorize_export(self, export_name: str) -> str:


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

The cyclomatic complexity of this function is 18. By comparison, 98% of the functions in the CodeGuru reference dataset have a lower cyclomatic complexity. This indicates the function has a high number of decisions and it can make the logic difficult to understand and test. We recommend that you simplify this function or break it into multiple functions.

bonclay7 · 2025-10-25T17:06:14Z

src/cdk/scripts/manage-exports.py

+        """Check if export value appears to be a URL."""
+        return value.startswith(("http://", "https://"))
+
+    def _get_console_url(


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

The cyclomatic complexity of this function is 17. By comparison, 98% of the functions in the CodeGuru reference dataset have a lower cyclomatic complexity. This indicates the function has a high number of decisions and it can make the logic difficult to understand and test.

We recommend that you simplify this function or break it into multiple functions. For example, consider extracting the code block on lines 661-666 into a separate function.

bonclay7 · 2025-10-25T17:06:15Z

src/cdk/scripts/manage-exports.py

+        logger.info(f"Target regions for scanning: {regions}")
+        return regions
+
+    def extract_exports(


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

This function contains 128 lines of code, not including blank lines or lines with only comments, Python punctuation characters, identifiers, or literals. By comparison, 99% of the functions in the CodeGuru reference dataset contain fewer lines of code. Large functions might be difficult to read and have logic that is hard to understand and test.

We recommend that you simplify this function or break it into multiple functions. For example, consider extracting the code block on lines 521-529 into a separate function.

bonclay7 · 2025-10-25T17:06:19Z

src/templates/codebuild-deployment-template.yaml

+                "FunctionName": "${rCDKStackListerFunction}",
+                "Payload": {}
+              },
+              "ResultPath": "$.stackList",


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

It appears that you have a refernce path in value of the file and you are not ending the key name with .$. Make sure to end the key name with .$.

Similar issue at line numbers 968, 977, 979, 990, 995, 1011, 1016, 1037, 1042, and 1163.

bonclay7 · 2025-10-25T17:06:21Z

src/templates/codebuild-deployment-template.yaml

+                  if cloudfront_domain:
+                      dashboard_url = f"{cloudfront_domain}/workshop-exports/index.html"
+                  elif assets_bucket:
+                      dashboard_url = f"https://{assets_bucket}.s3.amazonaws.com/workshop-exports/index.html"


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

Potential S3 bucket sniping vulnerability detected. This rule has identified S3 bucket references that could be vulnerable to bucket sniping attacks. Bucket sniping occurs when an attacker registers an S3 bucket name after finding it referenced in code but not yet created. This can lead to data exposure, malicious content hosting, or service disruption.

Recommendations:

Create all referenced S3 buckets immediately

Use organization-specific prefixes for bucket names

Verify bucket ownership before use

Consider using AWS Organizations S3 bucket naming rules

Discovered: workshop-exports

bonclay7 · 2025-10-25T17:06:23Z

src/cdk/scripts/README.md

+**S3 upload fails**: Check bucket exists and permissions allow PutObject
+
+```bash
+aws s3 ls s3://your-assets-bucket/


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

Potential S3 bucket sniping vulnerability detected. This rule has identified S3 bucket references that could be vulnerable to bucket sniping attacks. Bucket sniping occurs when an attacker registers an S3 bucket name after finding it referenced in code but not yet created. This can lead to data exposure, malicious content hosting, or service disruption.

Recommendations:

Create all referenced S3 buckets immediately

Use organization-specific prefixes for bucket names

Verify bucket ownership before use

Consider using AWS Organizations S3 bucket naming rules

Discovered: your-assets-bucket

bonclay7 · 2025-10-25T17:06:51Z

src/cdk/scripts/manage-exports.py

+                logger.info("CloudFront URL: %s", cloudfront_url)
+                return cloudfront_url
+
+            return s3_url


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

Untrusted data must be properly encoded or sanitized before being
incorporated into web page content or used to generate dynamic output.
Failure to do so can result in Cross-Site Scripting (XSS) vulnerabilities,
enabling attackers to inject malicious scripts into the application. These
scripts, when executed in users' browsers, can lead to various security
breaches such as session hijacking, data theft, or unauthorized actions
performed within the victim's session context. To mitigate this risk,
use built-in template escaping mechanisms, HTML escape functions like
html.escape(), or dedicated security libraries such as Bleach.
Learn more: https://owasp.org/www-community/attacks/xss/

bonclay7 · 2025-10-25T17:07:03Z

src/cdk/scripts/retrieve-config.sh

+    log_debug "Attempting to retrieve parameter from SSM..."
+
+    local ssm_output
+    local ssm_error


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

ssm_error appears unused. Verify use (or export if used externally).

bonclay7 · 2025-10-25T17:07:07Z

src/cdk/scripts/retrieve-config.sh

+            if [[ "$LOG_LEVEL" == "DEBUG" ]]; then
+                log_debug "Existing .env contents:"
+                log_debug "----------------------------------------------"
+                cat ".env" | sed 's/\(.*=\).*/\1[REDACTED]/' >&2


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

Unnecessary use of 'cat' in shell scripts, can lead to inefficient code and reduced script performance. Instead of 'cat file | command', use input redirection 'command < file' or pass the filename directly command file when possible. This practice improves script efficiency, especially for commands that benefit from seekable input. It also enhances code readability and maintainability. For more information on secure coding practices, including shell scripting, refer to the OWASP Secure Coding Practices Quick Reference Guide: https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/

bonclay7 · 2025-10-25T17:07:09Z

src/cdk/scripts/retrieve-config.sh

+            if [[ "$LOG_LEVEL" == "DEBUG" ]]; then
+                log_debug "Configuration file contents:"
+                log_debug "----------------------------------------------"
+                cat "$TARGET_ENV_FILE" | sed 's/\(.*=\).*/\1[REDACTED]/' >&2


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

Unnecessary use of 'cat' in shell scripts, can lead to inefficient code and reduced script performance. Instead of 'cat file | command', use input redirection 'command < file' or pass the filename directly command file when possible. This practice improves script efficiency, especially for commands that benefit from seekable input. It also enhances code readability and maintainability. For more information on secure coding practices, including shell scripting, refer to the OWASP Secure Coding Practices Quick Reference Guide: https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/

…449) - Pass configuration parameter name to DDB seeding step in pipeline - Add comprehensive error validation in get-parameter.sh script - Improve error handling in seed-dynamodb.sh for invalid table names - Add better logging and error messages for debugging - Support configuration parameter retrieval in seeding process

* fix: enhance DynamoDB seeding with error handling and config support - Pass configuration parameter name to DDB seeding step in pipeline - Add comprehensive error validation in get-parameter.sh script - Improve error handling in seed-dynamodb.sh for invalid table names - Add better logging and error messages for debugging - Support configuration parameter retrieval in seeding process * refactor: simplify DynamoDB seeding configuration Simplified DynamoDB seeding configuration by removing configurationParameterName parameter and streamlining environment variable handling. Updated pipeline.ts to remove unused parameter passing, modified storage.ts to use direct environment variable export instead of configuration parameter retrieval, and refactored get-parameter.sh script to rely on environment variables rather than parsing TypeScript files. * fix: pipeline status parsing error * fix: dependency for delete step function * fix: pipeline status parsing error * fix: improve error handling and datetime serialization in CodeBuild deployment template - Replace generic States.ALL error catch with specific States.TaskFailed handling - Add CheckDescribeError choice state to differentiate ValidationError from other failures - Add DeletionFailed state for proper non-validation error handling - Import datetime module and serialize CloudFormation stack timestamps to ISO format - Fix datetime serialization issues for CreationTime, LastUpdatedTime, and DeletionTime fields * feat: added awsApplication Tag * fix: export lambda * feat: removed awsApplication tag * fix: export retriever function improvement

bonclay7 · 2025-10-28T10:45:16Z

src/templates/codebuild-deployment-template.yaml

+                "FunctionName": "${rCDKStackListerFunction}",
+                "Payload": {}
+              },
+              "ResultPath": "$.stackList",


Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.

It appears that you have a refernce path in value of the file and you are not ending the key name with .$. Make sure to end the key name with .$.

Similar issue at line numbers 959, 968, 970, 981, 986, 995, 1013, 1018, 1039, and 1165.

* Change some styling * Fix build warning * Add formatting, parameter ARN for Waggle * fix: pre-commit issues * fix: renamed parameter for petfood agent --------- Co-authored-by: Rafael Pereyra <[email protected]>

* fix: enabled multi-region trail * feat: added listsecret permission to task * feat: add CloudFront log group to assets construct - Added LogGroup import from aws-cdk-lib/aws-logs - Added optional logRetentionDays property to AssetsProperties interface - Created CloudFrontLogGroup with configurable retention (defaults to ONE_WEEK) - Added comment explaining manual console configuration requirement due to CDK limitation - Set RemovalPolicy.DESTROY for the log group

…oyment scripts (#455) - Enhanced CONTRIBUTING.md with additional guidelines - Expanded application redeployment documentation with more detailed instructions - Updated petfood agent Python implementation - Modified CDK configurations for pay-for-adoption and petfood-agent microservices - Improved redeploy application script with enhanced functionality

* fix: updated petsite dependencies * fix: resolved dependency hell

* Unscope transaction deletes * bump dependencies

* Emit event for all food purchases * use non-default event bus * Allow some services to collect only otlp metrics * fixup! Allow some services to collect only otlp metrics * fixup! use non-default event bus * Run cargo fmt * Fix js lint

* use non-default event bus * Add stock processor function * Deploy stock processor lambda * fixup! Deploy stock processor lambda * add functions dependencies * specify bundling * Fix sending to default bus * cosmetic fixes * Remove go binary * Higher stock quantity * Drop x-Ray deps * fixup! Drop x-Ray deps

lambda traffic generator

* use non-default event bus * Verify pet availability before adoption * fix double service entry, fallback to OTLP * fixup! fix double service entry, fallback to OTLP * fixup! Verify pet availability before adoption * Improve error messages handling * Update pet availability in housekeeping API * fixup! Update pet availability in housekeeping API * More specific error message for pet not found in search * Revert "use non-default event bus" This reverts commit 7317134. * drop transactions for only successful status reset

feat: Basic structure proposal for cdk rewrite

73c6319

Added pre-commit hooks and other validation tools for this process

ci: skip ash failures while fixing the existing issues

4443779

rafaelpereyra had a problem deploying to acceptance July 30, 2025 16:31 — with GitHub Actions Error

feat: added cloudformation template for initial deployment

3287971

rafaelpereyra had a problem deploying to acceptance July 30, 2025 22:15 — with GitHub Actions Error

rapgaws and others added 21 commits July 31, 2025 11:48

fix: fixed ASH findings for template, re-enabled fail on findings for…

3970175

… new code

feat: improved codebuild template

0f7e680

feat: fixed cdk-nag issues

5c2d7a7

added PipelineArn output so initial Codebuild can succeed

refactor: rename CDK pipeline stack to OneObservabilityWorkshopPipeline

945811f

Changed CDK pipeline stack name from 'CDKPipeline' to 'OneObservabilityWorkshopPipeline' in workshop.ts

fix: enabled bucket versioning

f8bc451

fix: improve CloudFormation signaling in CDK deployment template

8686aae

- Add explicit SUCCESS signal when pipeline monitoring detects completion - Prevent duplicate signaling in final success handling - Enhance logging for better visibility of signaling events

Merge branch 'staging' into feat/cdkpipeline

671ea1e

feat: add OpenTelemetry instrumentation to petsite deployment

d3f3e2e

Added instrumentation.opentelemetry.io/inject-dotnet annotation to enable automatic .NET instrumentation injection for the petsite deployment.

ci: .net 8 for .net build

f65721f

rafaelpereyra changed the base branch from main to staging August 9, 2025 00:53

rapgaws added 2 commits August 8, 2025 21:06

ci: reorganize environment setup in CDK workflow

a87de9b

Move environment file copy operation from CDK synth step to separate earlier step for better workflow organization

bonclay7 reviewed Oct 25, 2025

View reviewed changes

rafaelpereyra added 2 commits October 27, 2025 11:32

bonclay7 reviewed Oct 28, 2025

View reviewed changes

rafaelpereyra and others added 16 commits October 28, 2025 10:19

fix: waf lognames must match prefix (#451)

5721314

Feat/cdkpipeline (#453)

f16821e

* Change some styling * Fix build warning * Add formatting, parameter ARN for Waggle * fix: pre-commit issues * fix: renamed parameter for petfood agent --------- Co-authored-by: Rafael Pereyra <[email protected]>

feat: enaled petfood agent and opensearch application (#454)

4253923

feat: refresh secrets every 5 mins (#456)

b603f0d

fix: cloudwatch init container by language (#457)

8844b6d

Fix/petsite otel (#458)

bca679f

* fix: updated petsite dependencies * fix: resolved dependency hell

fix: housekeeping (#459)

2acddd5

* Unscope transaction deletes * bump dependencies

feat: Cloudfront security improvements (#460)

fe8ebae

impr: petfood enhancements (#461)

dec04b7

* Emit event for all food purchases * use non-default event bus * Allow some services to collect only otlp metrics * fixup! Allow some services to collect only otlp metrics * fixup! use non-default event bus * Run cargo fmt * Fix js lint

lambda traffic genertor

7559f72

Merge pull request #463 from sguruvar/feat/cdkpipeline

0938921

lambda traffic generator

fix: pre-commit issues in cdkpipeline branch (#465)

279e3c4

rafaelpereyra requested a deployment to acceptance November 12, 2025 13:07 — with GitHub Actions Waiting

feat: CDK re-write --DO NOT MERGE-- #328

Are you sure you want to change the base?

feat: CDK re-write --DO NOT MERGE-- #328

Uh oh!

Conversation

rafaelpereyra commented Jul 30, 2025

Uh oh!

github-actions bot commented Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ASH Security Scan Report

Scan Metadata

Summary

Scanner Results

Top 10 Hotspots

Detailed Findings

Finding 1: CKV_AWS_111

Finding 2: CKV_DOCKER_2

Finding 3: CKV_DOCKER_3

Finding 4: CKV_DOCKER_2

Finding 5: CKV_DOCKER_3

Finding 6: CKV_DOCKER_2

Finding 7: CKV_DOCKER_2

Finding 8: CKV_DOCKER_3

Finding 9: CKV_DOCKER_2

Finding 10: CKV_DOCKER_3

Finding 11: CKV_DOCKER_7

Finding 12: CKV_DOCKER_2

Finding 13: CKV_DOCKER_3

Finding 14: CKV2_GHA_1

Finding 15: CKV2_GHA_1

Finding 16: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Finding 17: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Finding 18: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Finding 19: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Finding 20: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

github-actions bot commented Jul 30, 2025 •

edited

Loading