Skip to content

Commit 1c53b57

Browse files
committed
Add TCX5 waiver to inline policies to pass deny list check.
cr: https://code.amazon.com/reviews/CR-224753718
1 parent b3017b7 commit 1c53b57

File tree

6 files changed

+7
-9
lines changed

6 files changed

+7
-9
lines changed

v2/guide/attributes.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,6 @@
22
:arn-aws: pass:q[[.shared]``region.arn``]
33
:aws: pass:q[[.shared]``AWS``]
44
:aws-management-console: pass:q[[.shared]``consolelong``]
5+
6+
:tcx5-2025-waiver: pass:[ ]
7+

v2/guide/best-practices-security.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ include::attributes.txt[]
66
[[best-practices-security,best-practices-security.title]]
77
= {aws} CDK security best practices
88
:info_titleabbrev: Security
9-
:tcx5-2025-waiver: 		 	 	 
109
:keywords: {aws} CDK, IAM, security, permissions, infrastructure, {aws} CloudFormation, {aws} CDK deployments
1110

1211
[abstract]
@@ -131,4 +130,4 @@ If you want to work around this feature by replacing the automatically generated
131130
* A common workaround to using wildcards is to mandate that all resources be given a predictable name. However, this interferes with CloudFormation`'s ability to replace resources when necessary and may slow down or block development. Because of this, we recommend that you allow CloudFormation to create unique resource names for you.
132131
* It will be impossible to perform continuous delivery since manual actions must be performed prior to every deployment.
133132
134-
When organizations want to prevent the CDK from creating roles, it is usually to prevent developers from being able to create IAM roles. The concern is that by giving developers permission to create IAM roles using the {aws} CDK, they could possibly elevate their own privileges. To mitigate against this, we recommend using _permission boundaries_ or _service control policies (SCPs)_. With permission boundaries, you can set limits for what developers and the CDK are allowed to do. For more information on using permission boundaries with the CDK, see xref:customize-permissions-boundaries[Create and apply permissions boundaries for the {aws} CDK].
133+
When organizations want to prevent the CDK from creating roles, it is usually to prevent developers from being able to create IAM roles. The concern is that by giving developers permission to create IAM roles using the {aws} CDK, they could possibly elevate their own privileges. To mitigate against this, we recommend using _permission boundaries_ or _service control policies (SCPs)_. With permission boundaries, you can set limits for what developers and the CDK are allowed to do. For more information on using permission boundaries with the CDK, see xref:customize-permissions-boundaries[Create and apply permissions boundaries for the {aws} CDK].

v2/guide/bootstrapping-env.adoc

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ include::attributes.txt[]
55
[#bootstrapping-env]
66
= Bootstrap your environment for use with the {aws} CDK
77
:info_titleabbrev: Bootstrap your environment
8-
:tcx5-2025-waiver: 		 	 	 
98
:keywords: {aws} CDK, {aws} Cloud Development Kit ({aws} CDK), {aws} account, {aws} Region, Bootstrapping, Bootstrap, Environment
109

1110
[abstract]

v2/guide/hello-world.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ include::attributes.txt[]
88
:info_abstract: Get started with the {aws} Cloud Development Kit ({aws} CDK) by using the {aws} CDK Command Line Interface ({aws} CDK CLI) to develop your first \
99
CDK app, bootstrap your {aws} environment, and deploy your application on {aws}.
1010
:keywords: {aws} CDK, {aws} Cloud Development Kit ({aws} CDK), CDK app, {aws}, {aws} CloudFormation, Infrastructure as code, IaC
11-
:tcx5-2025-waiver: 		 	 	 
1211

1312
[abstract]
1413
--
@@ -1663,4 +1662,4 @@ For additional resources, see the following:
16631662
* Visit https://constructs.dev/search?q=&cdk=aws-cdk&cdkver=2&sort=downloadsDesc&offset=0[Construct Hub] to discover constructs created by {aws} and others.
16641663
* Explore https://github.com/aws-samples/aws-cdk-examples[Examples] of using the {aws} CDK.
16651664
1666-
The {aws} CDK is an open-source project. To contribute, see to https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md[Contributing to the {aws} Cloud Development Kit ({aws} CDK)].
1665+
The {aws} CDK is an open-source project. To contribute, see to https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md[Contributing to the {aws} Cloud Development Kit ({aws} CDK)].

v2/guide/serverless_example.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ include::attributes.txt[]
1010
= Tutorial: Create a serverless Hello World application
1111
:info_titleabbrev: Tutorial: Serverless Hello World application
1212
:info_abstract: In this tutorial, you use the {aws} CDK to create a simple serverless Hello World application that implements a basic API backend.
13-
:tcx5-2025-waiver: 		 	 	 
1413

1514
[abstract]
1615
--
@@ -1597,4 +1596,4 @@ $ aws lambda invoke --function-name CdkHelloWorldStack-HelloWorldFunctionunique-
15971596
If `output.txt` shows a successful Lambda function response, the issue could be with how you defined your API Gateway REST API. The {aws} CLI invokes your Lambda directly, not through your endpoint. Check your code to ensure it matches this tutorial. Then, deploy again.
15981597
+
15991598
*Possible cause: Lambda resource is defined incorrectly in your stack file*:::
1600-
If `output.txt` returns an error, the issue could be with how you defined your Lambda function. Check your code to ensure it matches this tutorial. Then deploy again.
1599+
If `output.txt` returns an error, the issue could be with how you defined your Lambda function. Check your code to ensure it matches this tutorial. Then deploy again.

v2/guide/testing.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ include::attributes.txt[]
66
[.topic]
77
[#testing]
88
= Test {aws} CDK applications
9-
:tcx5-2025-waiver: 		 	 	 
109

1110
// Content start
1211

@@ -1552,4 +1551,4 @@ Don't copy and paste setup lines or common assertions. Instead, refactor this lo
15521551
15531552
Don't try to do too much in one test. Preferably, a test should test one and only one behavior. If you accidentally break that behavior, exactly one test should fail, and the name of the test should tell you what failed. This is more an ideal to be striven for, however; sometimes you will unavoidably (or inadvertently) write tests that test more than one behavior. Snapshot tests are, for reasons we've already described, especially prone to this problem, so use them sparingly.
15541553
1555-
include::testing-locally.adoc[leveloffset=+1]
1554+
include::testing-locally.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)