Launched this week
CDK Insights
Catch security issues in your AWS CDK before deployment
61 followers
Catch security issues in your AWS CDK before deployment
61 followers
CDK Insights scans your AWS CDK stacks for security misconfigurations, cost waste, and best practice violations π Local-first: your code never leaves your machine β‘ Zero friction: no signup, no API keys, just npx cdk-insights scan π Free forever: 100+ rules, 35+ AWS services, JSON/Table/Markdown output π€ AI explains why issues matter, not just what's wrong π CI/CD ready: GitHub Action with PR comments Ship fast without shipping insecure.
CDK Insights
@theleepriestΒ For the free tier, any plans to add checks for unencrypted EBS volumes or Lambda env vars with secrets?Β
CDK Insights
@dayal_punjabiΒ Hello! ππ»
Both of those are already included in the free tier! CDK Insights checks for unencrypted EBS volumes and flags Lambda environment variables with sensitive key names (secrets, passwords, API keys, tokens, credentials, etc.) β recommending Secrets Manager or SSM Parameter Store instead
@theleepriestΒ Thank you for the response. And kudos to this launch.
Catching this at deploy time rather than after the fact is huge. IaC misconfigurations are one of those things that sit quietly until they don't. Does it handle cross-stack references? Some of the worst S3 exposure issues I've seen come from permissions that look fine in isolation but open up when stacks interact.
CDK Insights
@razazuΒ Great question! - cross-stack issues are genuinely one of the hardest things to catch, and you're right that they're often where the real exposure lives.
Right now, CDK Insights reasons about relationships within a single stack (dependencies, event source mappings, trust relationships between constructs), and the AI analysis specifically looks at how resources interact - e.g., flagging an SQS queue with no DLQ when it's feeding a Lambda, or an IAM role whose trust policy becomes too broad in combination with its attached policies.
Cross-stack analysis via imports/exports is on the roadmap, but not there yet - it's a harder problem because you need to resolve the full topology across multiple synth outputs and reason about transitive permissions. Would genuinely value your input on what the worst patterns you've seen look like - those concrete examples help me build the right detections rather than guess at them! π