AWS CDK Secure Constructs

Secure-by-default AWS CDK constructs with CDK property injection support.

Status: Early stage. Only S3 (SecureBucket) is implemented today. Requires aws-cdk-lib >= 2.196.0.

What it does

• Construct: SecureBucket — CIS-critical settings (encryption, block public access, SSL, object ownership) are always enforced.
• Tiers: HIGH / MEDIUM / LOW for operational settings (versioning, logging, removal policy).
• Injectors: Property injectors including TieredSecureBucketDefaults (tighten-only).
• Compliance: S3BucketCompliance.report() — enforced controls are verified by synthesis tests.

Property injectors set defaults; they do not block someone from using L1 CfnBucket directly.

Install

From npm (after publish):

npm install aws-cdk-secure-constructs

From this repo (local):

npm install
npm run build
npm run test:local-build   # pack + install + cdk synth

Usage

import { App, Stack } from 'aws-cdk-lib';
import { SecureBucket, SecurityLevel } from 'aws-cdk-secure-constructs';

const app = new App();
const stack = new Stack(app, 'MyStack');

new SecureBucket(stack, 'Data', {
  securityLevel: SecurityLevel.HIGH,
});

Tiered injector (org-wide floor):

import { PropertyInjectors } from 'aws-cdk-lib';
import { Bucket } from 'aws-cdk-lib/aws-s3';
import { TieredSecureBucketDefaults, SecurityLevel } from 'aws-cdk-secure-constructs';

PropertyInjectors.of(app).add(
  new TieredSecureBucketDefaults({ securityLevel: SecurityLevel.MEDIUM })
);
new Bucket(stack, 'RawBucket', { enforceSSL: false }); // CIS-critical fields still enforced

More examples: examples/, examples/local-consumer/ (tests the published tarball).

Development

npm install
npm run build      # jsii -> lib/
npm test
npm run lint
npm run test:local-build
npm run release -- patch   # from clean main only; tags and triggers CI publish

Docs

• API
• Security model
• Design guidelines
• Contributing
• Roadmap

License

MIT — see LICENSE.