feat(core): template validation after synthesis

package.json

@@ -82,8 +82,6 @@
       "@aws-cdk/assertions-alpha/fs-extra/**",
       "@aws-cdk/assertions/fs-extra",
       "@aws-cdk/assertions/fs-extra/**",
-      "@aws-cdk/aws-iot-actions-alpha/case",
-      "@aws-cdk/aws-iot-actions-alpha/case/**",
       "@aws-cdk/aws-codebuild/yaml",
       "@aws-cdk/aws-codebuild/yaml/**",
       "@aws-cdk/aws-codepipeline-actions/case",
@@ -98,6 +96,8 @@
       "@aws-cdk/aws-eks/yaml/**",
       "@aws-cdk/aws-events-targets/aws-sdk",
       "@aws-cdk/aws-events-targets/aws-sdk/**",
+      "@aws-cdk/aws-iot-actions-alpha/case",
+      "@aws-cdk/aws-iot-actions-alpha/case/**",
       "@aws-cdk/aws-iot-actions/case",
       "@aws-cdk/aws-iot-actions/case/**",
       "@aws-cdk/aws-s3-deployment/case",
@@ -110,12 +110,16 @@
       "@aws-cdk/cloudformation-include/yaml/**",
       "@aws-cdk/core/@balena/dockerignore",
       "@aws-cdk/core/@balena/dockerignore/**",
+      "@aws-cdk/core/cross-spawn",
+      "@aws-cdk/core/cross-spawn/**",
       "@aws-cdk/core/fs-extra",
       "@aws-cdk/core/fs-extra/**",
       "@aws-cdk/core/ignore",
       "@aws-cdk/core/ignore/**",
       "@aws-cdk/core/minimatch",
       "@aws-cdk/core/minimatch/**",
+      "@aws-cdk/core/table",
+      "@aws-cdk/core/table/**",
       "@aws-cdk/cx-api/semver",
       "@aws-cdk/cx-api/semver/**",
       "@aws-cdk/pipelines/aws-sdk",

packages/@aws-cdk/core/lib/app.ts

@@ -5,6 +5,7 @@ import { PRIVATE_CONTEXT_DEFAULT_STACK_SYNTHESIZER } from './private/private-con
 import { addCustomSynthesis, ICustomSynthesis } from './private/synthesis';
 import { IReusableStackSynthesizer } from './stack-synthesizers';
 import { Stage } from './stage';
+import { IValidationPlugin } from './validation/validation';
 
 const APP_SYMBOL = Symbol.for('@aws-cdk/core.App');
 
@@ -118,6 +119,12 @@ export interface AppProps {
    * @default - A `DefaultStackSynthesizer` with default settings
    */
   readonly defaultStackSynthesizer?: IReusableStackSynthesizer;
+
+  /**
+   * TODO
+   * @default - TODO
+   */
+  readonly validationPlugins?: IValidationPlugin[];
 }
 
 /**
@@ -152,6 +159,11 @@ export class App extends Stage {
    */
   public readonly _treeMetadata: boolean;
 
+  /**
+   * TODO docs
+   */
+  public readonly validationPlugins: IValidationPlugin[] = [];
+
   /**
    * Initializes a CDK application.
    * @param props initialization properties
@@ -186,6 +198,10 @@ export class App extends Stage {
       process.once('beforeExit', () => this.synth());
     }
 
+    if (props.validationPlugins) {
+      this.validationPlugins = props.validationPlugins;
+    }
+
     this._treeMetadata = props.treeMetadata ?? true;
   }
 

packages/@aws-cdk/core/lib/index.ts

@@ -64,6 +64,8 @@ export * from './cloudformation.generated';
 export * from './feature-flags';
 export * from './permissions-boundary';
 
+export * from './validation';
+
 // WARNING: Should not be exported, but currently is because of a bug. See the
 // class description for more information.
 export * from './private/intrinsic';

packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.ts

@@ -1,11 +1,12 @@
 import * as cxapi from '@aws-cdk/cx-api';
-import { DockerImageAssetLocation, DockerImageAssetSource, FileAssetLocation, FileAssetSource } from '../assets';
-import { Stack } from '../stack';
-import { Token } from '../token';
 import { assertBound, StringSpecializer } from './_shared';
 import { AssetManifestBuilder } from './asset-manifest-builder';
 import { StackSynthesizer } from './stack-synthesizer';
 import { ISynthesisSession, IReusableStackSynthesizer, IBoundStackSynthesizer } from './types';
+import { App } from '../app';
+import { DockerImageAssetLocation, DockerImageAssetSource, FileAssetLocation, FileAssetSource } from '../assets';
+import { Stack } from '../stack';
+import { Token } from '../token';
 
 export const BOOTSTRAP_QUALIFIER_CONTEXT = '@aws-cdk/core:bootstrapQualifier';
 
@@ -425,6 +426,21 @@ export class DefaultStackSynthesizer extends StackSynthesizer implements IReusab
     }
 
     const templateAssetSource = this.synthesizeTemplate(session, this.lookupRoleArn);
+
+    const app = App.of(this.boundStack);
+    if (App.isApp(app)) {
+      // TODO - We probably need to find a better place to add the validationPlugins
+      for (const plugin of app.validationPlugins) {
+        plugin.validate(session, templateAssetSource).then(report => {
+          // eslint-disable-next-line no-console
+          console.log(report.toString());
+        }).finally(() => {
+          // eslint-disable-next-line no-console
+          console.log('Validation complete');
+        });
+      }
+    }
+
     const templateAsset = this.addFileAsset(templateAssetSource);
 
     const assetManifestId = this.assetManifest.emitManifest(this.boundStack, session, {

packages/@aws-cdk/core/lib/validation/checkov.ts

@@ -0,0 +1,88 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { sync } from 'cross-spawn';
+import { IValidationPlugin, IValidation, ValidationContext, ValidationReport } from './validation';
+import { FileAssetSource } from '../assets';
+import { ISynthesisSession } from '../stack-synthesizers';
+
+// NOTE: This class will eventually move out to a separate repository, but we're
+// keeping it here for now to make it easier to iterate on.
+
+// Design decisions:
+// * We don't want to install checkov as a dependency of the CDK, so we'll just
+//   shell out to it.
+// * Each entry in the checkov output is a separate violation.
+
+/**
+ * TODO docs
+ */
+export class CheckovValiation implements IValidation {
+  /**
+   * TODO docs
+   */
+  async validate(context: ValidationContext): Promise<void> {
+    if (!this.isCheckovInstalled()) {
+      throw new Error('Checkov is not installed. Install it by running "pip install checkov".');
+    }
+
+    await this.checkPolicies(context);
+  }
+
+  private isCheckovInstalled(): boolean {
+    const { status } = sync('checkov', ['--version'], {
+      encoding: 'utf-8',
+      stdio: 'pipe',
+    });
+
+    return status === 0;
+  }
+
+  private async checkPolicies(context: ValidationContext): Promise<void> {
+    const flags = [
+      '-f',
+      context.templatePath,
+      '-o',
+      'json',
+    ];
+
+    const { status, output } = sync('checkov', flags, {
+      encoding: 'utf-8',
+      stdio: 'pipe',
+    });
+
+    const result = JSON.parse((output ?? []).join(''));
+
+    result.results.failed_checks.forEach((check: any) => {
+      context.report.addViolation({
+        fix: check.guideline,
+        recommendation: check.check_name,
+        ruleName: check.check_id,
+        violatingResource: {
+          resourceName: check.resource.split('.')[1],
+          templatePath: context.templatePath,
+          locations: check.check_result.evaluated_keys,
+        },
+      });
+    });
+
+    context.report.submit(status == 0 ? 'success' : 'failure');
+  }
+}
+
+/**
+ * TODO docs
+ */
+export class CheckovValidationPlugin implements IValidationPlugin {
+  private readonly validation = new CheckovValiation();
+
+  /**
+   * TODO docs
+   */
+  async validate(session: ISynthesisSession, source: FileAssetSource): Promise<ValidationReport> {
+    const templateAbsolutePath = path.join(process.cwd(), session.outdir, source.fileName ?? '');
+    const template = JSON.parse(fs.readFileSync(templateAbsolutePath, { encoding: 'utf-8' }));
+    const validationContext = new ValidationContext('Checkov', template, templateAbsolutePath);
+    await this.validation.validate(validationContext);
+    return validationContext.report;
+  }
+}

packages/@aws-cdk/core/lib/validation/index.ts

@@ -0,0 +1,2 @@
+export * from './validation';
+export * from './checkov';

packages/@aws-cdk/core/lib/validation/kics.ts

@@ -0,0 +1,102 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { sync } from 'cross-spawn';
+import { IValidation, IValidationPlugin, ValidationContext, ValidationReport } from './validation';
+import { FileAssetSource } from '../assets';
+import { ISynthesisSession } from '../stack-synthesizers';
+
+// NOTE: This class will eventually move out to a separate repository, but we're
+// keeping it here for now to make it easier to iterate on.
+
+/**
+ * TODO docs
+ */
+export class KicsValidation implements IValidation {
+  /**
+   * TODO docs
+   */
+  async validate(context: ValidationContext): Promise<void> {
+
+    await this.checkPolicies(context);
+  }
+
+  private async checkPolicies(context: ValidationContext): Promise<void> {
+    const [templateFolder, templateFileName] = this.splitPathAndFile(context.templatePath);
+
+    const flags = [
+      'run',
+      '-t',
+      `-v "${templateFolder}:/path"`,
+      'checkmarx/kics:latest',
+      'scan',
+      `-p /path/${templateFileName}`,
+      '-o "/path/"',
+      '--ci',
+      '--report-formats "json"',
+    ];
+
+    // eslint-disable-next-line no-console
+    console.log(flags.join(' '));
+
+    // TODO This is not working yet. When I run the command directly in the
+    // terminal it works, but here I'm getting a docker error regarding the
+    // volume name.
+    const { status, output } = sync('docker', flags, {
+      encoding: 'utf-8',
+      stdio: 'pipe',
+    });
+
+    // eslint-disable-next-line no-console
+    console.log('status: ', status);
+
+    // eslint-disable-next-line no-console
+    console.log('stdout: ', output);
+
+    const foo = fs.readFileSync(path.join(templateFolder, 'results.json'), { encoding: 'utf-8' });
+
+    const results = JSON.parse(foo);
+
+    results.queries.forEach((query: any) => {
+      query.files.forEach((file: any) => {
+        context.report.addViolation({
+          fix: 'N/A',
+          recommendation: query.description,
+          ruleName: query.query_name,
+          violatingResource: {
+            resourceName: file.resource_name,
+            templatePath: file.file_name,
+            locations: [file.search_key],
+          },
+        });
+      });
+    });
+
+    context.report.submit(status == 0 ? 'success' : 'failure');
+  }
+
+  private splitPathAndFile(input: string): string[] {
+    const splitPath = input.split('/');
+    const fileName = splitPath.pop();
+    const filePath = splitPath.join('/');
+
+    return [filePath, fileName!];
+  }
+}
+
+/**
+ * TODO docs
+ */
+export class KicsValidationPlugin implements IValidationPlugin {
+  private readonly validation = new KicsValidation();
+
+  /**
+   * TODO docs
+   */
+  async validate(session: ISynthesisSession, source: FileAssetSource): Promise<ValidationReport> {
+    const templateAbsolutePath = path.join(process.cwd(), session.outdir, source.fileName ?? '');
+    const template = JSON.parse(fs.readFileSync(templateAbsolutePath, { encoding: 'utf-8' }));
+    const validationContext = new ValidationContext('Kics', template, templateAbsolutePath);
+    await this.validation.validate(validationContext);
+    return validationContext.report;
+  }
+}