feat(sast): Add 10 TS CDK (#6194)

* add more 10 ts csk

* add tests to integration file

---------

Co-authored-by: Matan Shati <>
Co-authored-by: Omry Mendelovich <[email protected]>

cdk_integration_tests/src/typescript/IAMPolicyAttachedToGroupOrRoles/fail.ts

@@ -0,0 +1,6 @@
+import { aws_iam as iam } from 'aws-cdk-lib';
+
+const cfnSecurityConfigurationProps1: iam.PolicyProps = {
+  statements: [{}],
+  users: [{}]
+};

cdk_integration_tests/src/typescript/IAMPolicyAttachedToGroupOrRoles/fail2.ts

@@ -0,0 +1,26 @@
+import { aws_iam as iam } from 'aws-cdk-lib';
+
+const a = new iam.Policy(this, 'userpool-policy', {
+  statements: [new iam.PolicyStatement({
+    actions: ['cognito-idp:DescribeUserPool'],
+    resources: ['Arn'],
+  })],
+  users: ['sdsd']
+});
+
+const b = new iam.Policy(this, 'userpool-policy', {
+  statements: [new iam.PolicyStatement({
+    actions: ['cognito-idp:DescribeUserPool'],
+    resources: ['Arn'],
+  })],
+});
+console.log('dsd')
+b.attachToUser({})
+
+const c = new iam.Policy(this, 'userpool-policy', {
+  statements: [new iam.PolicyStatement({
+    actions: ['cognito-idp:DescribeUserPool'],
+    resources: ['Arn'],
+  })],
+});
+c.attachToUser({})

cdk_integration_tests/src/typescript/IAMPolicyAttachedToGroupOrRoles/pass.ts

@@ -0,0 +1,15 @@
+import { aws_iam as iam } from 'aws-cdk-lib';
+
+const a = new iam.Policy(this, 'userpool-policy', {
+  statements: [new iam.PolicyStatement({
+    actions: ['cognito-idp:DescribeUserPool'],
+    resources: ['Arn'],
+  })],
+});
+
+const cfnSecurityConfigurationProps1: iam.PolicyProps = {
+  statements: [new iam.PolicyStatement({
+    actions: ['cognito-idp:DescribeUserPool'],
+    resources: ['Arn'],
+  })],
+};

cdk_integration_tests/src/typescript/KinesisStreamEncryptionType/fail.ts

@@ -0,0 +1,10 @@
+import { aws_kinesis as kinesis } from 'aws-cdk-lib';
+
+const cfnSecurityConfigurationProps1: kinesis.CfnStreamProps = {
+  streamEncryption: { encryptionType: "None", keyId: "dfdf"},
+  name: 'name',
+};
+
+const cfnSecurityConfigurationProps2: kinesis.CfnStreamProps = {
+  name: 'name',
+};

cdk_integration_tests/src/typescript/KinesisStreamEncryptionType/fail2.ts

@@ -0,0 +1,10 @@
+import { aws_kinesis as kinesis } from 'aws-cdk-lib';
+
+const cfnSecurityConfiguration1 = new kinesis.CfnStream(this, 'MyCfnSecurityConfiguration', {
+  streamEncryption: { encryptionType: "None", keyId: "dfdf"},
+  name: 'name',
+});
+
+const cfnSecurityConfiguration2 = new kinesis.CfnStream(this, 'MyCfnSecurityConfiguration', {
+  name: 'name',
+});

cdk_integration_tests/src/typescript/KinesisStreamEncryptionType/pass.ts

@@ -0,0 +1,6 @@
+import { aws_kinesis as kinesis } from 'aws-cdk-lib';
+
+const cfnSecurityConfigurationProps1: kinesis.CfnStreamProps = {
+  streamEncryption: { encryptionType: "KMS", keyId: "dfdf"},
+  name: 'name',
+};

cdk_integration_tests/src/typescript/LambdaDLQConfigured/fail.ts

@@ -0,0 +1,16 @@
+import { aws_lambda as lambda } from 'aws-cdk-lib';
+import { aws_sam as sam } from 'aws-cdk-lib';
+
+const cfnSecurityConfigurationProps1: lambda.FunctionProps = {
+  name: 'name',
+  role: "",
+};
+
+const cfnSecurityConfigurationProps1: lambda.CfnFunctionProps = {
+  name: 'name',
+  role: "",
+};
+
+const cfnSecurityConfigurationProps2: sam.CfnFunctionProps = {
+  name: 'name',
+};

cdk_integration_tests/src/typescript/LambdaDLQConfigured/fail2.ts

@@ -0,0 +1,17 @@
+import { aws_lambda as lambda } from 'aws-cdk-lib';
+import { aws_sam as sam } from 'aws-cdk-lib';
+
+const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+});
+
+const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+});
+
+const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+});

cdk_integration_tests/src/typescript/LambdaDLQConfigured/pass.ts

@@ -0,0 +1,21 @@
+import {aws_lambda as lambda} from 'aws-cdk-lib';
+import {aws_sam as sam} from 'aws-cdk-lib';
+
+const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    deadLetterQueue: {},
+    deadLetterQueueEnabled: true,
+});
+
+const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    deadLetterConfig: {},
+});
+
+const cfnSecurityConfiguration2 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    deadLetterQueue: {},
+});

cdk_integration_tests/src/typescript/LambdaEnvironmentCredentials/fail.ts

@@ -0,0 +1,29 @@
+import {aws_lambda as lambda} from 'aws-cdk-lib';
+import {aws_sam as sam} from 'aws-cdk-lib';
+
+const cfnSecurityConfigurationProps1: lambda.FunctionProps = {
+    name: 'name',
+    role: "",
+    environment: {
+        "bla": "bla",
+    }
+};
+
+const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = {
+    name: 'name',
+    role: "",
+    environment: {
+        variables: {
+            "bla": "bla",
+        }
+    }
+};
+
+const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = {
+    name: 'name',
+    environment: {
+        variables: {
+            bla: "bla",
+        }
+    }
+};

cdk_integration_tests/src/typescript/LambdaEnvironmentCredentials/fail2.ts

@@ -0,0 +1,30 @@
+import { aws_lambda as lambda } from 'aws-cdk-lib';
+import { aws_sam as sam } from 'aws-cdk-lib';
+
+const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        "bla": "bla",
+    }
+});
+
+const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        variables: {
+            "bla": "bla",
+        }
+    }
+});
+
+const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        variables: {
+            bla: "bla",
+        }
+    }
+});

cdk_integration_tests/src/typescript/LambdaEnvironmentCredentials/pass.ts

@@ -0,0 +1,63 @@
+import {aws_lambda as lambda} from 'aws-cdk-lib';
+import {aws_sam as sam} from 'aws-cdk-lib';
+
+const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        "bla": "bla",
+    },
+    environmentEncryption: {}
+});
+
+const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        variables: {
+            "bla": "bla",
+        }
+    },
+    kmsKeyArn: "arn"
+});
+
+const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        variables: {
+            bla: "bla",
+        }
+    },
+    kmsKeyArn: "arn"
+});
+
+const cfnSecurityConfigurationProps1: lambda.FunctionProps = {
+    name: 'name',
+    role: "",
+    environment: {
+        "bla": "bla",
+    },
+    environmentEncryption: {}
+};
+
+const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = {
+    name: 'name',
+    role: "",
+    environment: {
+        variables: {
+            "bla": "bla",
+        }
+    },
+    kmsKeyArn: "arn"
+};
+
+const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = {
+    name: 'name',
+    environment: {
+        variables: {
+            bla: "bla",
+        }
+    },
+    kmsKeyArn: "arn"
+};

cdk_integration_tests/src/typescript/LambdaEnvironmentEncryptionSettings/fail.ts

@@ -0,0 +1,29 @@
+import {aws_lambda as lambda} from 'aws-cdk-lib';
+import {aws_sam as sam} from 'aws-cdk-lib';
+
+const cfnSecurityConfigurationProps1: lambda.FunctionProps = {
+    name: 'name',
+    role: "",
+    environment: {
+        "bla": "bla",
+    }
+};
+
+const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = {
+    name: 'name',
+    role: "",
+    environment: {
+        variables: {
+            "bla": "bla",
+        }
+    }
+};
+
+const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = {
+    name: 'name',
+    environment: {
+        variables: {
+            bla: "bla",
+        }
+    }
+};

cdk_integration_tests/src/typescript/LambdaEnvironmentEncryptionSettings/fail2.ts

@@ -0,0 +1,30 @@
+import { aws_lambda as lambda } from 'aws-cdk-lib';
+import { aws_sam as sam } from 'aws-cdk-lib';
+
+const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        "bla": "bla",
+    },
+});
+
+const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        variables: {
+            "bla": "bla",
+        }
+    }
+});
+
+const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+    environment: {
+        variables: {
+            bla: "bla",
+        }
+    }
+});

cdk_integration_tests/src/typescript/LambdaEnvironmentEncryptionSettings/pass.ts

@@ -0,0 +1,31 @@
+import {aws_lambda as lambda} from 'aws-cdk-lib';
+import {aws_sam as sam} from 'aws-cdk-lib';
+
+const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+});
+
+const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+});
+
+const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', {
+    role: "",
+    name: 'name',
+});
+
+const cfnSecurityConfigurationProps1: lambda.FunctionProps = {
+    name: 'name',
+    role: "",
+};
+
+const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = {
+    name: 'name',
+    role: "",
+};
+
+const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = {
+    name: 'name',
+};

cdk_integration_tests/src/typescript/LambdaFunctionLevelConcurrentExecutionLimit/fail.ts

@@ -0,0 +1,29 @@
+import {aws_lambda as lambda} from 'aws-cdk-lib';
+import {aws_sam as sam} from 'aws-cdk-lib';
+
+const cfnSecurityConfigurationProps1: lambda.FunctionProps = {
+    name: 'name',
+    role: "",
+    environment: {
+        "bla": "bla",
+    }
+};
+
+const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = {
+    name: 'name',
+    role: "",
+    environment: {
+        variables: {
+            "bla": "bla",
+        }
+    }
+};
+
+const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = {
+    name: 'name',
+    environment: {
+        variables: {
+            bla: "bla",
+        }
+    }
+};