AWS CDK Security

AWS CDK inherits CloudFormation security model with additional constructs for security best practices. Security focuses on IAM least privilege, encryption defaults, and integration with AWS security services.

CDK generates CloudFormation templates with explicit IAM policies. Grant least privilege via grant methods (grantRead, grantWrite). Custom IAM policies via PolicyDocument. CDK Nag (cdk-nag) enforces security best practices as aspect-oriented rules.

L2 constructs enable encryption by default (S3 buckets, EBS volumes, RDS). Secrets Manager integration via SecretValue. Parameter Store for configuration. KMS key management with automatic rotation. Cross-account key policies.

AWS WAF, Shield, GuardDuty, Security Hub, Config, and Inspector available as L2/L3 constructs. VPC security groups and NACLs via ec2.SecurityGroup. PrivateLink for service-to-service encryption. Certificate Manager for TLS.

cdk-nag rules (AwsSolutions, HIPAA, NIST) catch issues at synth time. CloudFormation Guard for policy-as-code. Service Control Policies (SCPs) at organization level. Config Rules for continuous compliance. CloudTrail for audit logging.

Construct Hub shows construct maturity and maintenance status. Provenance via npm/pypi/maven package signing. Dependabot for dependency updates. Lock files for reproducible builds. Private construct registries for enterprise.