feat: CDK re-write --DO NOT MERGE--

[rafaelpereyra]

Added pre-commit hooks and other validation tools for this process

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[github-actions]

ASH Security Scan Report

• Report generated: 2025-08-22T14:49:19+00:00
• Time since scan: 1 minute

Scan Metadata

• Project: ASH
• Scan executed: 2025-08-22T14:48:09+00:00
• ASH version: 3.0.0

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

• Severity levels:
  • Suppressed (S): Findings that have been explicitly suppressed and don't affect scanner status
  • Critical (C): Highest severity findings that require immediate attention
  • High (H): Serious findings that should be addressed soon
  • Medium (M): Moderate risk findings
  • Low (L): Lower risk findings
  • Info (I): Informational findings with minimal risk
• Duration (Time): Time taken by the scanner to complete its execution
• Actionable: Number of findings at or above the threshold severity level that require attention
• Result:
  • PASSED = No findings at or above threshold
  • FAILED = Findings at or above threshold
  • MISSING = Required dependencies not available
  • SKIPPED = Scanner explicitly disabled
• Threshold: The minimum severity level that will cause a scanner to fail
  • Thresholds: ALL, LOW, MEDIUM, HIGH, CRITICAL
  • Source: Values in parentheses indicate where the threshold is set:
    • global (global_settings section in the ASH_CONFIG used)
    • config (scanner config section in the ASH_CONFIG used)
    • scanner (default configuration in the plugin, if explicitly set)
• Statistics calculation:
  • All statistics are calculated from the final aggregated SARIF report
  • Suppressed findings are counted separately and do not contribute to actionable findings
  • Scanner status is determined by comparing actionable findings to the threshold

Scanner	Suppressed	Critical	High	Medium	Low	Info	Actionable	Result	Threshold
bandit	0	0	0	0	1	0	0	PASSED	MEDIUM (global)
cdk-nag	20	0	0	0	0	9	0	PASSED	MEDIUM (global)
cfn-nag	0	0	0	0	0	0	0	MISSING	MEDIUM (global)
checkov	13	14	0	0	0	0	14	FAILED	MEDIUM (global)
detect-secrets	0	0	0	0	0	0	0	SKIPPED	MEDIUM (global)
grype	0	1	0	3	0	0	4	FAILED	MEDIUM (global)
npm-audit	0	0	0	0	0	0	0	PASSED	MEDIUM (global)
opengrep	0	0	0	0	0	0	0	MISSING	MEDIUM (global)
semgrep	0	25	0	0	0	0	25	FAILED	MEDIUM (global)
syft	0	0	0	0	0	0	0	PASSED	MEDIUM (global)

Top 10 Hotspots

Files with the highest number of security findings:

Finding Count	File Location
7	src/applications/microservices/petsearch-java/docker-compose.yml
4	src/applications/microservices/payforadoption-go/benchmark/Dockerfile
4	src/applications/microservices/petlistadoptions-py/docker-compose.yml
3	src/applications/microservices/payforadoption-go/Dockerfile
3	src/applications/microservices/petsite-net/petsite/Dockerfile
3	src/applications/microservices/petfood-rs/docker-compose.test.yml
2	src/applications/microservices/petlistadoptions-py/Dockerfile
2	src/applications/microservices/petsearch-java/Dockerfile
2	src/applications/microservices/petfood-rs/Dockerfile.test
2	src/cdk/lib/microservices/manifests/petsite-deployment.yaml

Detailed Findings

Show 20 of 43 actionable findings

Finding 1: CKV_DOCKER_3

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_3
• Location: src/applications/microservices/petlistadoptions-py/Dockerfile:1-49

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM python:3.11-slim as builder

WORKDIR /app

# Install system dependencies
RUN apt-get update && apt-get install -y \
    gcc \
    libpq-dev \
    && rm -rf /var/lib/apt/lists/*

# Copy requirements and install Python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY . .

# Production stage
FROM python:3.11-slim

WORKDIR /app

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
    libpq5 \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Copy Python packages from builder
COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

# Copy application code
COPY --from=builder /app .

# Make start script executable
RUN chmod +x start.sh

# Create non-root user for future use (but run as root for port 80 access)
RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app

# Add health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:80/health/status || exit 1

EXPOSE 80

# Use startup script (running as root for port 80 access)
CMD ["./start.sh"]

---

Finding 2: CKV_DOCKER_2

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_2
• Location: src/applications/microservices/petsearch-java/Dockerfile:1-17

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM --platform=$BUILDPLATFORM public.ecr.aws/docker/library/gradle:7.3-jdk17 as build

WORKDIR /app
COPY ./build.gradle ./build.gradle
COPY ./src ./src
COPY ./settings.gradle ./settings.gradle

ENV GRADLE_OPTS "-Dorg.gradle.daemon=false"
RUN gradle build -DexcludeTags='integration' --no-daemon --stacktrace

FROM public.ecr.aws/amazoncorretto/amazoncorretto:17-al2-generic-jdk
WORKDIR /app

ARG JAR_FILE=build/libs/\*.jar
COPY --from=build /app/${JAR_FILE} ./app.jar

ENTRYPOINT ["java","-jar","/app/app.jar"]

---

Finding 3: CKV_DOCKER_3

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_3
• Location: src/applications/microservices/petsearch-java/Dockerfile:1-17

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM --platform=$BUILDPLATFORM public.ecr.aws/docker/library/gradle:7.3-jdk17 as build

WORKDIR /app
COPY ./build.gradle ./build.gradle
COPY ./src ./src
COPY ./settings.gradle ./settings.gradle

ENV GRADLE_OPTS "-Dorg.gradle.daemon=false"
RUN gradle build -DexcludeTags='integration' --no-daemon --stacktrace

FROM public.ecr.aws/amazoncorretto/amazoncorretto:17-al2-generic-jdk
WORKDIR /app

ARG JAR_FILE=build/libs/\*.jar
COPY --from=build /app/${JAR_FILE} ./app.jar

ENTRYPOINT ["java","-jar","/app/app.jar"]

---

Finding 4: CKV_DOCKER_2

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_2
• Location: src/applications/microservices/payforadoption-go/Dockerfile:1-14

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM public.ecr.aws/docker/library/golang:1.23 as builder
WORKDIR /go/src/app
COPY . .
ENV GOPROXY=https://goproxy.io,direct
RUN go get .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .

FROM public.ecr.aws/docker/library/alpine:3.22.1
WORKDIR /app
RUN apk --no-cache add ca-certificates
COPY --from=builder /go/src/app/app .
COPY --from=builder /go/src/app/seed.json .
EXPOSE 80
CMD ["./app"]

---

Finding 5: CKV_DOCKER_3

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_3
• Location: src/applications/microservices/payforadoption-go/Dockerfile:1-14

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM public.ecr.aws/docker/library/golang:1.23 as builder
WORKDIR /go/src/app
COPY . .
ENV GOPROXY=https://goproxy.io,direct
RUN go get .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .

FROM public.ecr.aws/docker/library/alpine:3.22.1
WORKDIR /app
RUN apk --no-cache add ca-certificates
COPY --from=builder /go/src/app/app .
COPY --from=builder /go/src/app/seed.json .
EXPOSE 80
CMD ["./app"]

---

Finding 6: CKV_DOCKER_2

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_2
• Location: src/applications/microservices/petfood-rs/Dockerfile.test:1-32

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM rust:1.75-slim

# Install system dependencies
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install cargo tools for testing
RUN cargo install cargo-tarpaulin

# Set working directory
WORKDIR /app

# Copy Cargo files first for better caching
COPY Cargo.toml Cargo.lock ./

# Create a dummy main.rs to build dependencies
RUN mkdir src && echo "fn main() {}" > src/main.rs

# Build dependencies
RUN cargo build --release && rm -rf src

# Copy source code
COPY . .

# Make test script executable
RUN chmod +x scripts/run_tests.sh

# Default command
CMD ["./scripts/run_tests.sh"]

---

Finding 7: CKV_DOCKER_3

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_3
• Location: src/applications/microservices/petfood-rs/Dockerfile.test:1-32

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM rust:1.75-slim

# Install system dependencies
RUN apt-get update && apt-get install -y \
    pkg-config \
    libssl-dev \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install cargo tools for testing
RUN cargo install cargo-tarpaulin

# Set working directory
WORKDIR /app

# Copy Cargo files first for better caching
COPY Cargo.toml Cargo.lock ./

# Create a dummy main.rs to build dependencies
RUN mkdir src && echo "fn main() {}" > src/main.rs

# Build dependencies
RUN cargo build --release && rm -rf src

# Copy source code
COPY . .

# Make test script executable
RUN chmod +x scripts/run_tests.sh

# Default command
CMD ["./scripts/run_tests.sh"]

---

Finding 8: CKV_DOCKER_2

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_2
• Location: src/applications/microservices/petfood-rs/Dockerfile:1-25

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

# Build stage
FROM rust:1.89-bookworm AS builder
COPY . .
RUN cargo build --release

# Runtime stage
FROM debian:bookworm-slim

# Install runtime dependencies and CA certificates
RUN apt-get update && apt-get install -y \
    ca-certificates \
    openssl \
    curl \
    && rm -rf /var/lib/apt/lists/* \
    && update-ca-certificates

COPY --from=builder /target/release/petfood-rs /app/petfood-rs

# Create a non-root user for security
RUN useradd -r -s /bin/false petfood && \
    chown petfood:petfood /app/petfood-rs

USER petfood
EXPOSE 8080
CMD ["/app/petfood-rs"]

---

Finding 9: CKV_DOCKER_2

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_2
• Location: src/applications/microservices/petsite-net/petsite/Dockerfile:1-20

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443
ENV ASPNETCORE_HTTP_PORTS=80

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY . .
RUN dotnet restore "PetSite.csproj"
RUN dotnet build "PetSite.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "PetSite.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
# Removed X-Ray daemon address environment variable
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "PetSite.dll"]

---

Finding 10: CKV_DOCKER_3

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_3
• Location: src/applications/microservices/petsite-net/petsite/Dockerfile:1-20

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443
ENV ASPNETCORE_HTTP_PORTS=80

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY . .
RUN dotnet restore "PetSite.csproj"
RUN dotnet build "PetSite.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "PetSite.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
# Removed X-Ray daemon address environment variable
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "PetSite.dll"]

---

Finding 11: CKV_DOCKER_7

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_7
• Location: src/applications/microservices/payforadoption-go/benchmark/Dockerfile:1

Description:
Ensure the base image uses a non latest version tag

Code Snippet:

FROM public.ecr.aws/docker/library/rust:latest:latest as builder

---

Finding 12: CKV_DOCKER_2

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_2
• Location: src/applications/microservices/payforadoption-go/benchmark/Dockerfile:1-6

Description:
Ensure that HEALTHCHECK instructions have been added to container images

Code Snippet:

FROM public.ecr.aws/docker/library/rust:latest:latest as builder
WORKDIR /app
RUN
COPY . .
RUN cargo install drill
CMD ["./benchmark.sh"]

---

Finding 13: CKV_DOCKER_3

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV_DOCKER_3
• Location: src/applications/microservices/payforadoption-go/benchmark/Dockerfile:1-6

Description:
Ensure that a user for the container has been created

Code Snippet:

FROM public.ecr.aws/docker/library/rust:latest:latest as builder
WORKDIR /app
RUN
COPY . .
RUN cargo install drill
CMD ["./benchmark.sh"]

---

Finding 14: CKV2_GHA_1

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV2_GHA_1
• Location: .github/workflows/tests.yml:1

Description:
Ensure top-level permissions are not set to write-all

---

Finding 15: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

• Severity: HIGH
• Scanner: semgrep
• Rule ID: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
• Location: src/applications/lambda/pethistory-node/index.js:103

Description:
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.

Code Snippet:

console.error(`Failed to process adoption for pet ${validatedData.petId}:`, error);

---

Finding 16: dockerfile.security.missing-user.missing-user

• Severity: HIGH
• Scanner: semgrep
• Rule ID: dockerfile.security.missing-user.missing-user
• Location: src/applications/microservices/payforadoption-go/Dockerfile:14

Description:
By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

Code Snippet:

CMD ["./app"]

---

Finding 17: dockerfile.security.missing-user.missing-user

• Severity: HIGH
• Scanner: semgrep
• Rule ID: dockerfile.security.missing-user.missing-user
• Location: src/applications/microservices/payforadoption-go/benchmark/Dockerfile:6

Description:
By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.

Code Snippet:

CMD ["./benchmark.sh"]

---

Finding 18: go.lang.security.audit.net.use-tls.use-tls

• Severity: HIGH
• Scanner: semgrep
• Rule ID: go.lang.security.audit.net.use-tls.use-tls
• Location: src/applications/microservices/payforadoption-go/main.go:157

Description:
Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.

Code Snippet:

errs <- http.ListenAndServe(*httpAddr, h)

---

Finding 19: go.lang.security.audit.crypto.math_random.math-random-used

• Severity: HIGH
• Scanner: semgrep
• Rule ID: go.lang.security.audit.crypto.math_random.math-random-used
• Location: src/applications/microservices/payforadoption-go/payforadoption/utils.go:12

Description:
Do not use math/rand. Use crypto/rand instead.

Code Snippet:

"math/rand"

---

Finding 20: yaml.docker-compose.security.no-new-privileges.no-new-privileges

• Severity: HIGH
• Scanner: semgrep
• Rule ID: yaml.docker-compose.security.no-new-privileges.no-new-privileges
• Location: src/applications/microservices/petfood-rs/docker-compose.test.yml:4

Description:
Service 'localstack' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

Code Snippet:

localstack:

Note: Showing 20 of 43 total actionable findings. Configure max_detailed_findings to adjust this limit.

---

Report generated by Automated Security Helper (ASH) at 2025-08-22T14:49:19+00:00