Cognito User Pool Error AwsSolutions-COG3

General Issue

My stack adds “AdvancedSecurityMode” : “ENFORCED” but cdk-nag raises Error

The Question

I am running CDK 2.41.0 (build 6ad48a3) on Windows 10 using Python 3.9.12. I am deploying a Cognito User Pool. Since CDK apparently does not support “AdvancedSecurityMode”, I used the Cloud Formation “escape hatch” to add it to my User Pool.

        user_pool.node.default_child.add_property_override(
            'UserPoolAddOns.AdvancedSecurityMode',
            'ENFORCED'
        )

When I deploy my stack, I can see in the AWS Console that my User Pool does have “AdvancedSecurityMode” enabled. But cdk-nag doesn’t see it. The output is:

[Error at /Cognito-test-ech/CognitoUserPool/Resource] AwsSolutions-COG3: The Cognito user pool does not have AdvancedSecurityMode set to ENFORCED.

I am not clear on how cdk-nag introspects my stack, so I didn’t open a Bug, but I need help understanding if this is a bug or not.

cdk-nag version

“2.18.12”

Language

Python

Other information

No response

[jrobbins-LiveData]

I understand. I guess I was initially surprised that cdk-nag would raise an error about a resource setting that CDK doesn’t allow one to set. But, it is definitely better to know about it in order to do something about it! Thanks for explaining!

[jrobbins-LiveData]

I initially thought that cdk-nag would tell me I hadn’t set the right property using CDK, and so I was surprised to getting “nagged” about something that CDK doesn’t let me (directly) fix. But it all makes sense, as I know CDK is a work-in-progress. I’m glad the rules are independent of what’s easy to do with CDK, because we want to make our app secure, and need to know. Thanks again!