AWS cdk medium security documentation change
Summary
Updated Security Hub references to 'Security Hub CSPM' and clarified findings rationale
Security assessment
Directly addresses Security Hub CSPM findings related to CDK bootstrapping resources, explaining why flagged configurations aren't security risks. Provides specific evidence of security analysis ('reviewed with AWS Security') and mitigates potential false positive concerns
Diff
diff --git a/cdk/v1/guide/bootstrapping.md b/cdk/v1/guide/bootstrapping.md index 09f911f25..6b8c547dd 100644 --- a//cdk/v1/guide/bootstrapping.md +++ b//cdk/v1/guide/bootstrapping.md @@ -683 +683 @@ Template version | AWS CDK version | Changes -If you are using AWS Security Hub, you may see findings reported on some of the resources created by the AWS CDK Bootstrapping process. Security Hub findings help you find resource configurations you should double-check for accuracy and safety. We have reviewed these specific resource configurations with AWS Security and are confident they do not constitute a security problem. +If you are using AWS Security Hub CSPM, you may see findings reported on some of the resources created by the AWS CDK Bootstrapping process. Security Hub CSPM findings help you find resource configurations you should double-check for accuracy and safety. We have reviewed these specific resource configurations with AWS Security and are confident they do not constitute a security problem. @@ -689 +689 @@ The Deploy Role (default name `cdk-hnb659fds-deploy-role-ACCOUNT-REGION`) has pe -**Why does Security Hub flag this?** The policy contains a `Resource: *` combined with a `Condition` clause; Security Hub is flagging the `*`. The `*` is necessary because at the time the account is bootstrapped, the AWS KMS key created by AWS CDK Pipelines for the CodePipeline Artifact Bucket does not exist yet so we can't reference its ARN. In addition, Security Hub does not include the `Condition` clause in the policy statement in its reasoning. +**Why does Security Hub flag this?** The policy contains a `Resource: *` combined with a `Condition` clause; Security Hub CSPM is flagging the `*`. The `*` is necessary because at the time the account is bootstrapped, the AWS KMS key created by AWS CDK Pipelines for the CodePipeline Artifact Bucket does not exist yet so we can't reference its ARN. In addition, Security Hub CSPM does not include the `Condition` clause in the policy statement in its reasoning.