CDK makes it easy to ship infrastructure fast. What I found running it in production is that a passing cdk synth is not the same as a safe deploy - there are four categories of risk a standard CI/CD pipeline leaves unchecked: IaC policy violations, CloudFormation template errors, application code quality issues, and vulnerable dependencies. Each one has a tool that catches it at build time.
cdk-nag is the only CDK-specific tool - the others work with any CI/CD pipeline.
| Tool | When it runs | What it catches |
|---|---|---|
| cdk-nag | cdk synth | IaC policy violations |
| cfn-lint | cdk synth | CloudFormation template errors |
| SonarQube | build | Code quality and security hotspots |
| OWASP Dependency-Check | build | Vulnerable dependencies |
The series
Chapter 1 - Policy Checks with cdk-nag
cdk-nag runs NagPacks (AwsSolutions, HIPAA, NIST, PCI DSS) against the synthesised CDK app at synth time - violations block the build before any CloudFormation changeset is created.
Chapter 2 - Template Linting with cfn-lint (coming soon)
cfn-lint validates the synthesised CloudFormation template for invalid properties, deprecated fields, and best practice violations.
Chapter 3 - Static Analysis with SonarQube (coming soon)
SonarQube runs static analysis on the application code and gates the pipeline on quality thresholds - bugs, security hotspots, code smells.
Chapter 4 - Dependency Scanning with OWASP (coming soon)
OWASP Dependency-Check scans Python and Node dependencies against the CVE database and fails the build on any HIGH or above finding.
Notes
- The series assumes CDK familiarity. The Infrastructure as Code with AWS CDK series covers project setup, constructs, configuration, testing, and CI/CD pipelines.