feat(ci): security guardian changes

[kumvprat]

Issue # (if applicable)

N/A - Enhancement and bug fixes for Security Guardian tool.

Reason for this change

Security guardian is first line of defense for scanning policy, roles and permissions vended by CDK for customers. This GH Action is critical to determine if a PR change is providing secure-by-default policies for any changes introduced in CDK.

The Security Guardian tool needed several critical improvements to function properly:

1. CFN Intrinsic Resolution: Missing comprehensive support for CloudFormation intrinsic functions like Fn::Sub, Fn::Select, Fn::Contains, etc.
2. Rule Coverage: Incomplete security rule coverage across AWS services
3. Create noise: Current setup of security guardian does not provide benefit as it fails to exclude cases where the generic cfn-guard rule might not work. Like with KMS secrets or secret manager secrets

Description of changes

Added template preprocessing pipeline with intrinsic resolution and policy normalization, details can be found below

Major Enhancements:

• Complete CFN Intrinsic Function Resolver: Added comprehensive support for all CloudFormation intrinsic functions including Fn::Sub with literal escaping, Fn::Select with bounds checking, Fn::Contains, Fn::Split, Fn::Cidr, Fn::Base64, and shorthand forms (!Ref, !GetAtt, etc.)
• Cross-Stack Resolution: Implemented resource registry for resolving Fn::ImportValue and cross-template references
• Policy Normalization: Added IAM policy normalizer to resolve intrinsics within policy documents before validation
• Output presentation: Integrated JUnit XML output with GitHub Actions using pinned mikepenz/action-junit-report for rich PR feedback ( suggested by cfn-guard here)
• Security report generation workflow : Separated out report generation into another workflow due to 2 reasons :
  • Gives us flexibility to change the trigger type for security-guardian to lower permissive trigger likepull_request or pull_request_review
  • Allows fork PRs to run : Fork PRs trigger workflow runs with read permissions, and the separate workflow can execute separate from the fork PR call chain with full permissions needed to update checks and annotation on the PR

Security Rule Expansion:

• Added comprehensive guard rules for 13 AWS services: CodePipeline, DataTrace, DocumentDB, EC2, IAM, Kinesis, Neptune, Redshift, S3, SNS, SQS, and trust scope validation
• Enhanced existing rules with better coverage for broad principals, wildcard actions, and cross-account access patterns

Describe any new or updated permissions being added

No new IAM permissions required. All changes are to the static analysis tool and GitHub Actions workflow.

Description of how you validated changes

Unit Testing: via

• Guard Rule Syntax: All 13 guard rule files pass cfn-guard v3 parser validation
• Cross-Stack Testing: Validated resolution of Fn::ImportValue and cross-template references
• Example cases to test that the current set of rules PASS and FAIL for different scenarios

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

[kumvprat]

This how a run would look like

This is how annotations look on the code