DevSecOps Guardrails - Series Overview
CDK makes it easy to ship infrastructure fast. What I found running it in production is that a passing cdk synth is not the same as a safe deploy - there are four categories of risk a standard CI/CD pipeline leaves unchecked: IaC policy violations, CloudFormation template errors, application code quality issues, and vulnerable dependencies. Each one has a tool that catches it at build time. cdk-nag is the only CDK-specific tool - the others work with any CI/CD pipeline. ...