Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

bug: cdk-nag Annotations do not work with stages

See original GitHub issue

What is the problem?

cdk-nag does not work with Stages. If an app contains a stage, it is not possible to apply cdk-nag at the app, stage, or stack level.

Reproduction Steps

#!/usr/bin/env node

const cdk = require('aws-cdk-lib');
const { Stack, Stage, App } = require('aws-cdk-lib');
const sqs = require('aws-cdk-lib/aws-sqs');
const s3 = require('aws-cdk-lib/aws-s3');
const { AwsSolutionsChecks } = require("cdk-nag")

class MyStack extends Stack {
  constructor(scope, id, props) {
    super(scope, id, props);

    new sqs.Queue(this, 'Queue', {
      removalPolicy: cdk.RemovalPolicy.DESTROY,

    new s3.Bucket(this, 'Bucket', {})

class TestStage extends Stage {
  constructor(scope, id, props) {
    super(scope, id, props);

    const s = new MyStack(this, 'MyStack');

    // This does nothing
    cdk.Aspects.of(s).add(new AwsSolutionsChecks({
      verbose: true

const app = new App();

const myStack = new MyStack(app, 'TestStack')

// This works
cdk.Aspects.of(myStack).add(new AwsSolutionsChecks({
  verbose: true

new TestStage(app, 'TestStage');

What did you expect to happen?

I expect cdk-nag to work if my stacks are in a stage.

What actually happened?

Nothing happens unless you pull the stack up to the app level when you instantiate it.

cdk-nag version




Other information

Also, cdk-nag 2.6.0 is broken on NPM. You can’t do a default install.


I created a file called nag.ts, in which I directly instantiate my stacks at the app level. I synthesize it with the following npm script:

"nag": "cdk synth --app='npx ts-node test/nag.ts'"

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Reactions:2
  • Comments:11

github_iconTop GitHub Comments

dontiruncommented, Nov 10, 2022

Closing since,this is related to the implementation of stages and is an intended behavior. Running cdk synth '**' or cdk synth Stage/* will produce the desired Annotations as mentioned here

dontiruncommented, Apr 25, 2022

This isn’t something that seems to be fixable within this construct.

I believe it’s related to this cdk issue

Read more comments on GitHub >

github_iconTop Results From Across the Web

annotations not applied if using stages · Issue #22507 · aws ...
Describe the bug Annotations are not applied when a Stack is deployed as part of a Stage. This seems to be related to...
Read more >
Check AWS CDK applications or CloudFormation templates ...
Integrate cdk-nag into your AWS CDK applications to apply rule packs and quickly detect and remediate code based on best practices.
Read more >
Mastering AWS CDK Aspects - Jannik Wempe
AWS CDK Aspects are a powerful tool provided by the AWS Cloud Development Kit (CDK). Learn how to master them by creating various...
Read more >
Manage application security and compliance with the ... - Noise
cdk-nag integrates directly into AWS Cloud Development Kit (AWS CDK) ... ","Non-Compliant","N/A","Error","The S3 Bucket does not have public ...
Read more >
Governance and security with infrastructure as code - Awsstatic
analysis. Secure bill of materials. Package assets. Shift left ... Works on smallest ... Bucket does not have public access restricted and blocked....
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Post

No results found

github_iconTop Related Hashnode Post

No results found