Nag suppression add resource suppressions after creation of Ora Conta…

…iner Image
umccr · Nov 2, 2024 · 79d54a4 · 79d54a4
1 parent c467161
commit 79d54a4
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 18 deletions.
diff --git a/lib/workload/components/ora-file-decompression-fq-pair-sfn/index.ts b/lib/workload/components/ora-file-decompression-fq-pair-sfn/index.ts
@@ -59,23 +59,6 @@ export class OraDecompressionConstruct extends Construct {
       },
     });
 
-    // FIXME - cdk nag error on fargate task definition role
-    // {
-    //   "Action": "ecr:GetAuthorizationToken",
-    //   "Effect": "Allow",
-    //   "Resource": "*"
-    // },
-    NagSuppressions.addResourceSuppressions(
-      taskDefinition,
-      [
-        {
-          id: 'AwsSolutions-IAM5',
-          reason: 'Fargate has GetAuthorizationToken permission on all resources by default',
-        },
-      ],
-      true
-    );
-
     // Add permission to task role
     const icav2SecretObj = secretsManager.Secret.fromSecretNameV2(
       this,
@@ -119,6 +102,23 @@ export class OraDecompressionConstruct extends Construct {
     // Allow step function to run the ECS task
     taskDefinition.grantRun(this.sfnObject);
 
+    // FIXME - cdk nag error on fargate task definition role
+    // {
+    //   "Action": "ecr:GetAuthorizationToken",
+    //   "Effect": "Allow",
+    //   "Resource": "*"
+    // },
+    NagSuppressions.addResourceSuppressions(
+      taskDefinition,
+      [
+        {
+          id: 'AwsSolutions-IAM5',
+          reason: 'Fargate has GetAuthorizationToken permission on all resources by default',
+        },
+      ],
+      true
+    );
+
     /* Grant the state machine access to monitor the tasks */
     this.sfnObject.addToRolePolicy(
       new iam.PolicyStatement({

diff --git a/lib/workload/stateless/stacks/ora-decompression-manager/deploy/index.ts b/lib/workload/stateless/stacks/ora-decompression-manager/deploy/index.ts
@@ -1,6 +1,5 @@
 import * as cdk from 'aws-cdk-lib';
 import { Construct } from 'constructs';
-import * as ssm from 'aws-cdk-lib/aws-ssm';
 import * as events from 'aws-cdk-lib/aws-events';
 import * as secretsManager from 'aws-cdk-lib/aws-secretsmanager';
 import { OraDecompressionConstruct } from '../../../../components/ora-file-decompression-fq-pair-sfn';