cdk-nag

Enforce AWS CDK security and compliance controls with cdk-nag.

9|Updated Feb 21, 2026
One-click install
npx skills add https://github.com/pantheon-org/tekhne --skill cdk-nag
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: cdk-nag
Source: https://github.com/pantheon-org/tekhne/tree/main/skills/infrastructure/aws-cdk/cdk-nag
Command: npx skills add https://github.com/pantheon-org/tekhne --skill cdk-nag

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps ensure your AWS CDK infrastructure adheres to security and compliance best practices by automatically identifying and flagging potential misconfigurations.

Core Features & Use Cases

  • Automated Security Checks: Enforces security and compliance rules on your AWS CDK stacks.
  • Suppression Management: Provides clear guidance on how to justify and apply suppressions for valid exceptions.
  • CI/CD Integration: Offers patterns for integrating security checks directly into your pipelines.
  • Use Case: Prevent insecure infrastructure patterns by automatically validating your CDK code against a set of predefined security rules before deployment.

Quick Start

Run the bun cli/index.ts audit all command to audit all skills in the repository.

Frequently Asked Questions about cdk-nag

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce security and compliance controls in AWS CDK?

To enforce AWS CDK security, you can use cdk-nag to automatically identify insecure infrastructure patterns and flag potential misconfigurations within your CDK stacks before deployment.

Can I integrate AWS CDK security checks into a CI/CD pipeline?

Yes, you can integrate AWS CDK security checks into CI/CD pipelines to achieve continuous security validation, automatically identifying and triaging insecure infrastructure patterns during the build process.

What is the best way to handle false positives during AWS CDK compliance validation?

For AWS CDK compliance validation, you can manage justified suppressions for valid exceptions, providing clear guidance on how to apply and document suppressions within your CDK stacks.

How do I audit all AWS CDK stacks for insecure infrastructure patterns?

To audit all AWS CDK stacks for insecure patterns, run the `bun cli/index.ts audit all` command, which executes cdk-nag rules against your infrastructure code to identify security findings.

Do I need cdk-nag to prevent insecure infrastructure patterns in AWS CDK?

You need cdk-nag to prevent insecure AWS CDK infrastructure patterns because it automatically validates your CDK code against a set of predefined security rules, ensuring adherence to best practices.