(aws-cloudfront): cdk-nag and Lambda@EDGE issues - AwsSolutions-IAM4 rule

[robertd]

Describe the bug

When trying to apply cdk-nag project to my current aws-cdk project (CF + OAI + S3 solution) I started seeing errors I cannot suppress/fix.

It seems that NagSuppressions does not apply to cloudfront.experimental.EdgeFunction.

...

const edgeLambda = new cloudfront.experimental.EdgeFunction(this, `lambda-edge-${index}`, {
  runtime: config.runtime,
  handler: config.handler, // i.e.: "index.handler"
  code: lambda.Code.fromAsset(path.join(__dirname, config.path)), // i.e.: "lambda/common"
});

// Suppress rule for AWSLambdaBasicExecutionRole
NagSuppressions.addResourceSuppressions(
  edgeLambda,
  [
    {
      id: 'AwsSolutions-IAM4',
      reason: 'Suppress AwsSolutions-IAM4 for AWSLambdaBasicExecutionRole',
      appliesTo: [
        'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
      ],
    },
  ],
  true,
);

Expected Behavior

Expected cdk-nag suppression to work.

// Suppress rule for AWSLambdaBasicExecutionRole
NagSuppressions.addResourceSuppressions(
  edgeLambda,
  [
    {
      id: 'AwsSolutions-IAM4',
      reason: 'Suppress AwsSolutions-IAM4 for AWSLambdaBasicExecutionRole',
      appliesTo: [
        'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
      ],
    },
  ],
  true,
);

Current Behavior

[Error at /lambda-edge/lambda-edge-0/ServiceRole/Resource] AwsSolutions-IAM4[Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]: The IAM user, role, or group uses AWS managed policies. An AWS managed policy is a standalone policy that is created and administered by AWS. Currently, many AWS managed policies do not restrict resource scope. Replace AWS managed policies with system specific (customer) managed policies.This is a granular rule that returns individual findings that can be suppressed with 'appliesTo'. The findings are in the format 'Policy::<policy>' for AWS managed policies. Example: appliesTo: ['Policy::arn:<AWS::Partition>:iam::aws:policy/foo'].

Reproduction Steps

See above.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.86.0

Framework Version

No response

Node.js Version

18

OS

Ventura 13.4.1

Language

Typescript

Language Version

No response

Other information

No response

[robertd]

I found this cdklabs/cdk-nag#1306... but I wasn't able to get it to work with multiple edge functions associated with CF distro.

[pahud]

I guess the best place is to call out is cdk-nag as this looks like a cdk-nag feature?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.