(assertions): Should `Annotations` impact unit tests?
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
With a `Stack` of:
```ts
// cdk_test-stack.ts
import { Aspects, Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Bucket } from 'aws-cdk-lib/aws-s3';
import { AwsSolutionsChecks } from "cdk-nag";
export class CdkTestStack extends Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);
const bucket = new Bucket(this, 'Bucket');
Aspects.of(this).add(new AwsSolutionsChecks({ verbose: true }));
}
}
```
We get errors via `Annotations` at `synth` time:
```console
➜ npx cdk synth
[Error at /CdkTestStack/Bucket/Resource] AwsSolutions-S1: The S3 Bucket has server access logs disabled. The bucket should have server access logging enabled to provide detailed records for the requests that are made to the bucket.
[Error at /CdkTestStack/Bucket/Resource] AwsSolutions-S10: The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.
Found errors
```
However, with a unit test of:
```ts
// cdk_test-stack.test.ts
import {App} from "aws-cdk-lib";
import {Template} from "aws-cdk-lib/assertions";
import {CdkTestStack} from "./cdk_test-stack";
describe('The test stack', () => {
it('matches the snapshot', () => {
const app = new App();
const stack = new CdkTestStack(app, 'cdk-test-stack');
expect(Template.fromStack(stack).toJSON()).toMatchSnapshot();
});
});
```
`npm test` does not observe the error `Annotations`. More specifically, `Template.fromStack` does not observe `Annotations`.
IIUC `Template.fromStack` is in the synth step[^1], so it's curious that error `Annotations` are not observed. Is this correct? Should an error `Annotation` prevent a stack from being synthed in all scenarios?
[^1]: https://docs.aws.amazon.com/cdk/v2/guide/apps.html#lifecycle
### Expected Behavior
Error `Annotations` should prevent template synthesis in all scenarios.
### Current Behavior
Error `Annotations` do not cause errors in unit tests.
### Reproduction Steps
See above.
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.126.0 (build fb74c41)
### Framework Version
_No response_
### Node.js Version
v20.10.0
### OS
macOS 14.3
### Language
TypeScript
### Language Version
TypeScript 5.3.3
### Other information
Code examples are taken from https://aws.amazon.com/blogs/devops/manage-application-security-and-compliance-with-the-aws-cloud-development-kit-and-cdk-nag/.
I don't think this is an issue with [cdk-nag](https://github.com/cdklabs/cdk-nag), but with `Annotations`. Hence raising this issue here. Let me know if this is incorrect though.
Contributor guide
Research direction
Start with the reproduction in cdk_test-stack.test.ts and compare Template.fromStack(stack) with the Aspects and Annotations behavior shown in cdk_test-stack.ts. Run the provided npm test and cdk synth commands, then trace whether synthesis through Template.fromStack should surface error annotations. Done means the intended behavior is established and covered by a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- infrastructure, testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100