# API Reference
## Structs
### AnnotationLoggerProps
Props for the AnnotationLogger.
#### Initializer
```typescript
import { AnnotationLoggerProps } from 'cdk-nag'
const annotationLoggerProps: AnnotationLoggerProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| logIgnores | boolean | Whether or not to log suppressed rule violations as informational messages (default: false). |
| verbose | boolean | Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages. |
---
##### `logIgnores`Optional
```typescript
public readonly logIgnores: boolean;
```
- *Type:* boolean
Whether or not to log suppressed rule violations as informational messages (default: false).
---
##### `verbose`Optional
```typescript
public readonly verbose: boolean;
```
- *Type:* boolean
Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages.
---
### NagLoggerBaseData
Shared data for all INagLogger methods.
#### Initializer
```typescript
import { NagLoggerBaseData } from 'cdk-nag'
const nagLoggerBaseData: NagLoggerBaseData = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| nagPackName | string | *No description.* |
| resource | aws-cdk-lib.CfnResource | *No description.* |
| ruleExplanation | string | *No description.* |
| ruleId | string | *No description.* |
| ruleInfo | string | *No description.* |
| ruleLevel | NagMessageLevel | *No description.* |
| ruleOriginalName | string | *No description.* |
---
##### `nagPackName`Required
```typescript
public readonly nagPackName: string;
```
- *Type:* string
---
##### `resource`Required
```typescript
public readonly resource: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
---
##### `ruleExplanation`Required
```typescript
public readonly ruleExplanation: string;
```
- *Type:* string
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleInfo`Required
```typescript
public readonly ruleInfo: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: NagMessageLevel;
```
- *Type:* NagMessageLevel
---
##### `ruleOriginalName`Required
```typescript
public readonly ruleOriginalName: string;
```
- *Type:* string
---
### NagLoggerComplianceData
Data for onCompliance method of an INagLogger.
#### Initializer
```typescript
import { NagLoggerComplianceData } from 'cdk-nag'
const nagLoggerComplianceData: NagLoggerComplianceData = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| nagPackName | string | *No description.* |
| resource | aws-cdk-lib.CfnResource | *No description.* |
| ruleExplanation | string | *No description.* |
| ruleId | string | *No description.* |
| ruleInfo | string | *No description.* |
| ruleLevel | NagMessageLevel | *No description.* |
| ruleOriginalName | string | *No description.* |
---
##### `nagPackName`Required
```typescript
public readonly nagPackName: string;
```
- *Type:* string
---
##### `resource`Required
```typescript
public readonly resource: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
---
##### `ruleExplanation`Required
```typescript
public readonly ruleExplanation: string;
```
- *Type:* string
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleInfo`Required
```typescript
public readonly ruleInfo: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: NagMessageLevel;
```
- *Type:* NagMessageLevel
---
##### `ruleOriginalName`Required
```typescript
public readonly ruleOriginalName: string;
```
- *Type:* string
---
### NagLoggerErrorData
Data for onError method of an INagLogger.
#### Initializer
```typescript
import { NagLoggerErrorData } from 'cdk-nag'
const nagLoggerErrorData: NagLoggerErrorData = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| nagPackName | string | *No description.* |
| resource | aws-cdk-lib.CfnResource | *No description.* |
| ruleExplanation | string | *No description.* |
| ruleId | string | *No description.* |
| ruleInfo | string | *No description.* |
| ruleLevel | NagMessageLevel | *No description.* |
| ruleOriginalName | string | *No description.* |
| errorMessage | string | *No description.* |
---
##### `nagPackName`Required
```typescript
public readonly nagPackName: string;
```
- *Type:* string
---
##### `resource`Required
```typescript
public readonly resource: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
---
##### `ruleExplanation`Required
```typescript
public readonly ruleExplanation: string;
```
- *Type:* string
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleInfo`Required
```typescript
public readonly ruleInfo: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: NagMessageLevel;
```
- *Type:* NagMessageLevel
---
##### `ruleOriginalName`Required
```typescript
public readonly ruleOriginalName: string;
```
- *Type:* string
---
##### `errorMessage`Required
```typescript
public readonly errorMessage: string;
```
- *Type:* string
---
### NagLoggerNonComplianceData
Data for onNonCompliance method of an INagLogger.
#### Initializer
```typescript
import { NagLoggerNonComplianceData } from 'cdk-nag'
const nagLoggerNonComplianceData: NagLoggerNonComplianceData = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| nagPackName | string | *No description.* |
| resource | aws-cdk-lib.CfnResource | *No description.* |
| ruleExplanation | string | *No description.* |
| ruleId | string | *No description.* |
| ruleInfo | string | *No description.* |
| ruleLevel | NagMessageLevel | *No description.* |
| ruleOriginalName | string | *No description.* |
| findingId | string | *No description.* |
---
##### `nagPackName`Required
```typescript
public readonly nagPackName: string;
```
- *Type:* string
---
##### `resource`Required
```typescript
public readonly resource: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
---
##### `ruleExplanation`Required
```typescript
public readonly ruleExplanation: string;
```
- *Type:* string
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleInfo`Required
```typescript
public readonly ruleInfo: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: NagMessageLevel;
```
- *Type:* NagMessageLevel
---
##### `ruleOriginalName`Required
```typescript
public readonly ruleOriginalName: string;
```
- *Type:* string
---
##### `findingId`Required
```typescript
public readonly findingId: string;
```
- *Type:* string
---
### NagLoggerNotApplicableData
Data for onNotApplicable method of an INagLogger.
#### Initializer
```typescript
import { NagLoggerNotApplicableData } from 'cdk-nag'
const nagLoggerNotApplicableData: NagLoggerNotApplicableData = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| nagPackName | string | *No description.* |
| resource | aws-cdk-lib.CfnResource | *No description.* |
| ruleExplanation | string | *No description.* |
| ruleId | string | *No description.* |
| ruleInfo | string | *No description.* |
| ruleLevel | NagMessageLevel | *No description.* |
| ruleOriginalName | string | *No description.* |
---
##### `nagPackName`Required
```typescript
public readonly nagPackName: string;
```
- *Type:* string
---
##### `resource`Required
```typescript
public readonly resource: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
---
##### `ruleExplanation`Required
```typescript
public readonly ruleExplanation: string;
```
- *Type:* string
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleInfo`Required
```typescript
public readonly ruleInfo: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: NagMessageLevel;
```
- *Type:* NagMessageLevel
---
##### `ruleOriginalName`Required
```typescript
public readonly ruleOriginalName: string;
```
- *Type:* string
---
### NagLoggerSuppressedData
Data for onSuppressed method of an INagLogger.
#### Initializer
```typescript
import { NagLoggerSuppressedData } from 'cdk-nag'
const nagLoggerSuppressedData: NagLoggerSuppressedData = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| nagPackName | string | *No description.* |
| resource | aws-cdk-lib.CfnResource | *No description.* |
| ruleExplanation | string | *No description.* |
| ruleId | string | *No description.* |
| ruleInfo | string | *No description.* |
| ruleLevel | NagMessageLevel | *No description.* |
| ruleOriginalName | string | *No description.* |
| findingId | string | *No description.* |
| suppressionReason | string | *No description.* |
---
##### `nagPackName`Required
```typescript
public readonly nagPackName: string;
```
- *Type:* string
---
##### `resource`Required
```typescript
public readonly resource: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
---
##### `ruleExplanation`Required
```typescript
public readonly ruleExplanation: string;
```
- *Type:* string
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleInfo`Required
```typescript
public readonly ruleInfo: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: NagMessageLevel;
```
- *Type:* NagMessageLevel
---
##### `ruleOriginalName`Required
```typescript
public readonly ruleOriginalName: string;
```
- *Type:* string
---
##### `findingId`Required
```typescript
public readonly findingId: string;
```
- *Type:* string
---
##### `suppressionReason`Required
```typescript
public readonly suppressionReason: string;
```
- *Type:* string
---
### NagLoggerSuppressedErrorData
Data for onSuppressedError method of an INagLogger.
#### Initializer
```typescript
import { NagLoggerSuppressedErrorData } from 'cdk-nag'
const nagLoggerSuppressedErrorData: NagLoggerSuppressedErrorData = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| nagPackName | string | *No description.* |
| resource | aws-cdk-lib.CfnResource | *No description.* |
| ruleExplanation | string | *No description.* |
| ruleId | string | *No description.* |
| ruleInfo | string | *No description.* |
| ruleLevel | NagMessageLevel | *No description.* |
| ruleOriginalName | string | *No description.* |
| errorMessage | string | *No description.* |
| errorSuppressionReason | string | *No description.* |
---
##### `nagPackName`Required
```typescript
public readonly nagPackName: string;
```
- *Type:* string
---
##### `resource`Required
```typescript
public readonly resource: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
---
##### `ruleExplanation`Required
```typescript
public readonly ruleExplanation: string;
```
- *Type:* string
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleInfo`Required
```typescript
public readonly ruleInfo: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: NagMessageLevel;
```
- *Type:* NagMessageLevel
---
##### `ruleOriginalName`Required
```typescript
public readonly ruleOriginalName: string;
```
- *Type:* string
---
##### `errorMessage`Required
```typescript
public readonly errorMessage: string;
```
- *Type:* string
---
##### `errorSuppressionReason`Required
```typescript
public readonly errorSuppressionReason: string;
```
- *Type:* string
---
### NagPackProps
Interface for creating a NagPack.
#### Initializer
```typescript
import { NagPackProps } from 'cdk-nag'
const nagPackProps: NagPackProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| additionalLoggers | INagLogger[] | Additional NagLoggers for logging rule validation outputs. |
| logIgnores | boolean | Whether or not to log suppressed rule violations as informational messages (default: false). |
| reportFormats | NagReportFormat[] | If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV). |
| reports | boolean | Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true). |
| suppressionIgnoreCondition | INagSuppressionIgnore | Conditionally prevent rules from being suppressed (default: no user provided condition). |
| verbose | boolean | Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false). |
---
##### `additionalLoggers`Optional
```typescript
public readonly additionalLoggers: INagLogger[];
```
- *Type:* INagLogger[]
Additional NagLoggers for logging rule validation outputs.
---
##### `logIgnores`Optional
```typescript
public readonly logIgnores: boolean;
```
- *Type:* boolean
Whether or not to log suppressed rule violations as informational messages (default: false).
---
##### `reportFormats`Optional
```typescript
public readonly reportFormats: NagReportFormat[];
```
- *Type:* NagReportFormat[]
If reports are enabled, the output formats of compliance reports in the App's output directory (default: only CSV).
---
##### `reports`Optional
```typescript
public readonly reports: boolean;
```
- *Type:* boolean
Whether or not to generate compliance reports for applied Stacks in the App's output directory (default: true).
---
##### `suppressionIgnoreCondition`Optional
```typescript
public readonly suppressionIgnoreCondition: INagSuppressionIgnore;
```
- *Type:* INagSuppressionIgnore
Conditionally prevent rules from being suppressed (default: no user provided condition).
---
##### `verbose`Optional
```typescript
public readonly verbose: boolean;
```
- *Type:* boolean
Whether or not to enable extended explanatory descriptions on warning, error, and logged ignore messages (default: false).
---
### NagPackSuppression
Interface for creating a rule suppression.
#### Initializer
```typescript
import { NagPackSuppression } from 'cdk-nag'
const nagPackSuppression: NagPackSuppression = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| id | string | The id of the rule to ignore. |
| reason | string | The reason to ignore the rule (minimum 10 characters). |
| appliesTo | string \| RegexAppliesTo[] | Rule specific granular suppressions. |
---
##### `id`Required
```typescript
public readonly id: string;
```
- *Type:* string
The id of the rule to ignore.
---
##### `reason`Required
```typescript
public readonly reason: string;
```
- *Type:* string
The reason to ignore the rule (minimum 10 characters).
---
##### `appliesTo`Optional
```typescript
public readonly appliesTo: (string | RegexAppliesTo)[];
```
- *Type:* string | RegexAppliesTo[]
Rule specific granular suppressions.
---
### NagReportLine
#### Initializer
```typescript
import { NagReportLine } from 'cdk-nag'
const nagReportLine: NagReportLine = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| compliance | string | *No description.* |
| exceptionReason | string | *No description.* |
| resourceId | string | *No description.* |
| ruleId | string | *No description.* |
| ruleInfo | string | *No description.* |
| ruleLevel | string | *No description.* |
---
##### `compliance`Required
```typescript
public readonly compliance: string;
```
- *Type:* string
---
##### `exceptionReason`Required
```typescript
public readonly exceptionReason: string;
```
- *Type:* string
---
##### `resourceId`Required
```typescript
public readonly resourceId: string;
```
- *Type:* string
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleInfo`Required
```typescript
public readonly ruleInfo: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: string;
```
- *Type:* string
---
### NagReportLoggerProps
Props for the NagReportLogger.
#### Initializer
```typescript
import { NagReportLoggerProps } from 'cdk-nag'
const nagReportLoggerProps: NagReportLoggerProps = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| formats | NagReportFormat[] | *No description.* |
---
##### `formats`Required
```typescript
public readonly formats: NagReportFormat[];
```
- *Type:* NagReportFormat[]
---
### NagReportSchema
#### Initializer
```typescript
import { NagReportSchema } from 'cdk-nag'
const nagReportSchema: NagReportSchema = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| lines | NagReportLine[] | *No description.* |
---
##### `lines`Required
```typescript
public readonly lines: NagReportLine[];
```
- *Type:* NagReportLine[]
---
### RegexAppliesTo
A regular expression to apply to matching findings.
#### Initializer
```typescript
import { RegexAppliesTo } from 'cdk-nag'
const regexAppliesTo: RegexAppliesTo = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| regex | string | An ECMA-262 regex string. |
---
##### `regex`Required
```typescript
public readonly regex: string;
```
- *Type:* string
An ECMA-262 regex string.
---
### SuppressionIgnoreInput
Information about the NagRule and the relevant NagSuppression for the INagSuppressionIgnore.
#### Initializer
```typescript
import { SuppressionIgnoreInput } from 'cdk-nag'
const suppressionIgnoreInput: SuppressionIgnoreInput = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| findingId | string | *No description.* |
| reason | string | *No description.* |
| resource | aws-cdk-lib.CfnResource | *No description.* |
| ruleId | string | *No description.* |
| ruleLevel | NagMessageLevel | *No description.* |
---
##### `findingId`Required
```typescript
public readonly findingId: string;
```
- *Type:* string
---
##### `reason`Required
```typescript
public readonly reason: string;
```
- *Type:* string
---
##### `resource`Required
```typescript
public readonly resource: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
---
##### `ruleId`Required
```typescript
public readonly ruleId: string;
```
- *Type:* string
---
##### `ruleLevel`Required
```typescript
public readonly ruleLevel: NagMessageLevel;
```
- *Type:* NagMessageLevel
---
## Classes
### AnnotationLogger
- *Implements:* INagLogger
A NagLogger that outputs to the CDK Annotations system.
#### Initializers
```typescript
import { AnnotationLogger } from 'cdk-nag'
new AnnotationLogger(props?: AnnotationLoggerProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | AnnotationLoggerProps | *No description.* |
---
##### `props`Optional
- *Type:* AnnotationLoggerProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| onCompliance | Called when a CfnResource passes the compliance check for a given rule. |
| onError | Called when a rule throws an error during while validating a CfnResource for compliance. |
| onNonCompliance | Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. |
| onNotApplicable | Called when a rule does not apply to the given CfnResource. |
| onSuppressed | Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. |
| onSuppressedError | Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. |
---
##### `onCompliance`
```typescript
public onCompliance(_data: NagLoggerComplianceData): void
```
Called when a CfnResource passes the compliance check for a given rule.
###### `_data`Required
- *Type:* NagLoggerComplianceData
---
##### `onError`
```typescript
public onError(data: NagLoggerErrorData): void
```
Called when a rule throws an error during while validating a CfnResource for compliance.
###### `data`Required
- *Type:* NagLoggerErrorData
---
##### `onNonCompliance`
```typescript
public onNonCompliance(data: NagLoggerNonComplianceData): void
```
Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user.
###### `data`Required
- *Type:* NagLoggerNonComplianceData
---
##### `onNotApplicable`
```typescript
public onNotApplicable(_data: NagLoggerNotApplicableData): void
```
Called when a rule does not apply to the given CfnResource.
###### `_data`Required
- *Type:* NagLoggerNotApplicableData
---
##### `onSuppressed`
```typescript
public onSuppressed(data: NagLoggerSuppressedData): void
```
Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user.
###### `data`Required
- *Type:* NagLoggerSuppressedData
---
##### `onSuppressedError`
```typescript
public onSuppressedError(data: NagLoggerSuppressedErrorData): void
```
Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed.
###### `data`Required
- *Type:* NagLoggerSuppressedErrorData
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| logIgnores | boolean | *No description.* |
| verbose | boolean | *No description.* |
| suppressionId | string | *No description.* |
---
##### `logIgnores`Required
```typescript
public readonly logIgnores: boolean;
```
- *Type:* boolean
---
##### `verbose`Required
```typescript
public readonly verbose: boolean;
```
- *Type:* boolean
---
##### `suppressionId`Required
```typescript
public readonly suppressionId: string;
```
- *Type:* string
---
### AwsSolutionsChecks
Check Best practices based on AWS Solutions Security Matrix.
#### Initializers
```typescript
import { AwsSolutionsChecks } from 'cdk-nag'
new AwsSolutionsChecks(props?: NagPackProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | NagPackProps | *No description.* |
---
##### `props`Optional
- *Type:* NagPackProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| visit | All aspects can visit an IConstruct. |
---
##### `visit`
```typescript
public visit(node: IConstruct): void
```
All aspects can visit an IConstruct.
###### `node`Required
- *Type:* constructs.IConstruct
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| readPackName | string | *No description.* |
---
##### `readPackName`Required
```typescript
public readonly readPackName: string;
```
- *Type:* string
---
### HIPAASecurityChecks
Check for HIPAA Security compliance.
Based on the HIPAA Security AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-hipaa_security.html
#### Initializers
```typescript
import { HIPAASecurityChecks } from 'cdk-nag'
new HIPAASecurityChecks(props?: NagPackProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | NagPackProps | *No description.* |
---
##### `props`Optional
- *Type:* NagPackProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| visit | All aspects can visit an IConstruct. |
---
##### `visit`
```typescript
public visit(node: IConstruct): void
```
All aspects can visit an IConstruct.
###### `node`Required
- *Type:* constructs.IConstruct
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| readPackName | string | *No description.* |
---
##### `readPackName`Required
```typescript
public readonly readPackName: string;
```
- *Type:* string
---
### NagPack
- *Implements:* aws-cdk-lib.IAspect
Base class for all rule packs.
#### Initializers
```typescript
import { NagPack } from 'cdk-nag'
new NagPack(props?: NagPackProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | NagPackProps | *No description.* |
---
##### `props`Optional
- *Type:* NagPackProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| visit | All aspects can visit an IConstruct. |
---
##### `visit`
```typescript
public visit(node: IConstruct): void
```
All aspects can visit an IConstruct.
###### `node`Required
- *Type:* constructs.IConstruct
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| readPackName | string | *No description.* |
---
##### `readPackName`Required
```typescript
public readonly readPackName: string;
```
- *Type:* string
---
### NagReportLogger
- *Implements:* INagLogger
A NagLogger that creates compliance reports.
#### Initializers
```typescript
import { NagReportLogger } from 'cdk-nag'
new NagReportLogger(props: NagReportLoggerProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | NagReportLoggerProps | *No description.* |
---
##### `props`Required
- *Type:* NagReportLoggerProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| getFormatStacks | *No description.* |
| onCompliance | Called when a CfnResource passes the compliance check for a given rule. |
| onError | Called when a rule throws an error during while validating a CfnResource for compliance. |
| onNonCompliance | Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. |
| onNotApplicable | Called when a rule does not apply to the given CfnResource. |
| onSuppressed | Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. |
| onSuppressedError | Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. |
---
##### `getFormatStacks`
```typescript
public getFormatStacks(format: NagReportFormat): string[]
```
###### `format`Required
- *Type:* NagReportFormat
---
##### `onCompliance`
```typescript
public onCompliance(data: NagLoggerComplianceData): void
```
Called when a CfnResource passes the compliance check for a given rule.
###### `data`Required
- *Type:* NagLoggerComplianceData
---
##### `onError`
```typescript
public onError(data: NagLoggerErrorData): void
```
Called when a rule throws an error during while validating a CfnResource for compliance.
###### `data`Required
- *Type:* NagLoggerErrorData
---
##### `onNonCompliance`
```typescript
public onNonCompliance(data: NagLoggerNonComplianceData): void
```
Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user.
###### `data`Required
- *Type:* NagLoggerNonComplianceData
---
##### `onNotApplicable`
```typescript
public onNotApplicable(data: NagLoggerNotApplicableData): void
```
Called when a rule does not apply to the given CfnResource.
###### `data`Required
- *Type:* NagLoggerNotApplicableData
---
##### `onSuppressed`
```typescript
public onSuppressed(data: NagLoggerSuppressedData): void
```
Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user.
###### `data`Required
- *Type:* NagLoggerSuppressedData
---
##### `onSuppressedError`
```typescript
public onSuppressedError(data: NagLoggerSuppressedErrorData): void
```
Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed.
###### `data`Required
- *Type:* NagLoggerSuppressedErrorData
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| formats | NagReportFormat[] | *No description.* |
---
##### `formats`Required
```typescript
public readonly formats: NagReportFormat[];
```
- *Type:* NagReportFormat[]
---
### NagRules
Helper class with methods for rule creation.
#### Initializers
```typescript
import { NagRules } from 'cdk-nag'
new NagRules()
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
---
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| resolveIfPrimitive | Use in cases where a primitive value must be known to pass a rule. |
| resolveResourceFromInstrinsic | *No description.* |
| resolveResourceFromIntrinsic | Use in cases where a token resolves to an intrinsic function and the referenced resource must be known to pass a rule. |
---
##### `resolveIfPrimitive`
```typescript
import { NagRules } from 'cdk-nag'
NagRules.resolveIfPrimitive(node: CfnResource, parameter: any)
```
Use in cases where a primitive value must be known to pass a rule.
https://developer.mozilla.org/en-US/docs/Glossary/Primitive
###### `node`Required
- *Type:* aws-cdk-lib.CfnResource
The CfnResource to check.
---
###### `parameter`Required
- *Type:* any
The value to attempt to resolve.
---
##### ~~`resolveResourceFromInstrinsic`~~
```typescript
import { NagRules } from 'cdk-nag'
NagRules.resolveResourceFromInstrinsic(node: CfnResource, parameter: any)
```
###### `node`Required
- *Type:* aws-cdk-lib.CfnResource
The CfnResource to check.
---
###### `parameter`Required
- *Type:* any
The value to attempt to resolve.
---
##### `resolveResourceFromIntrinsic`
```typescript
import { NagRules } from 'cdk-nag'
NagRules.resolveResourceFromIntrinsic(node: CfnResource, parameter: any)
```
Use in cases where a token resolves to an intrinsic function and the referenced resource must be known to pass a rule.
###### `node`Required
- *Type:* aws-cdk-lib.CfnResource
The CfnResource to check.
---
###### `parameter`Required
- *Type:* any
The value to attempt to resolve.
---
### NagSuppressions
Helper class with methods to add cdk-nag suppressions to cdk resources.
#### Initializers
```typescript
import { NagSuppressions } from 'cdk-nag'
new NagSuppressions()
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
---
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| addResourceSuppressions | Add cdk-nag suppressions to a CfnResource and optionally its children. |
| addResourceSuppressionsByPath | Add cdk-nag suppressions to a CfnResource and optionally its children via its path. |
| addStackSuppressions | Apply cdk-nag suppressions to a Stack and optionally nested stacks. |
---
##### `addResourceSuppressions`
```typescript
import { NagSuppressions } from 'cdk-nag'
NagSuppressions.addResourceSuppressions(construct: IConstruct | IConstruct[], suppressions: NagPackSuppression[], applyToChildren?: boolean)
```
Add cdk-nag suppressions to a CfnResource and optionally its children.
###### `construct`Required
- *Type:* constructs.IConstruct | constructs.IConstruct[]
The IConstruct(s) to apply the suppression to.
---
###### `suppressions`Required
- *Type:* NagPackSuppression[]
A list of suppressions to apply to the resource.
---
###### `applyToChildren`Optional
- *Type:* boolean
Apply the suppressions to children CfnResources (default:false).
---
##### `addResourceSuppressionsByPath`
```typescript
import { NagSuppressions } from 'cdk-nag'
NagSuppressions.addResourceSuppressionsByPath(stack: Stack, path: string | string[], suppressions: NagPackSuppression[], applyToChildren?: boolean)
```
Add cdk-nag suppressions to a CfnResource and optionally its children via its path.
###### `stack`Required
- *Type:* aws-cdk-lib.Stack
The Stack the construct belongs to.
---
###### `path`Required
- *Type:* string | string[]
The path(s) to the construct in the provided stack.
---
###### `suppressions`Required
- *Type:* NagPackSuppression[]
A list of suppressions to apply to the resource.
---
###### `applyToChildren`Optional
- *Type:* boolean
Apply the suppressions to children CfnResources (default:false).
---
##### `addStackSuppressions`
```typescript
import { NagSuppressions } from 'cdk-nag'
NagSuppressions.addStackSuppressions(stack: Stack, suppressions: NagPackSuppression[], applyToNestedStacks?: boolean)
```
Apply cdk-nag suppressions to a Stack and optionally nested stacks.
###### `stack`Required
- *Type:* aws-cdk-lib.Stack
The Stack to apply the suppression to.
---
###### `suppressions`Required
- *Type:* NagPackSuppression[]
A list of suppressions to apply to the stack.
---
###### `applyToNestedStacks`Optional
- *Type:* boolean
Apply the suppressions to children stacks (default:false).
---
### NIST80053R4Checks
Check for NIST 800-53 rev 4 compliance.
Based on the NIST 800-53 rev 4 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_4.html
#### Initializers
```typescript
import { NIST80053R4Checks } from 'cdk-nag'
new NIST80053R4Checks(props?: NagPackProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | NagPackProps | *No description.* |
---
##### `props`Optional
- *Type:* NagPackProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| visit | All aspects can visit an IConstruct. |
---
##### `visit`
```typescript
public visit(node: IConstruct): void
```
All aspects can visit an IConstruct.
###### `node`Required
- *Type:* constructs.IConstruct
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| readPackName | string | *No description.* |
---
##### `readPackName`Required
```typescript
public readonly readPackName: string;
```
- *Type:* string
---
### NIST80053R5Checks
Check for NIST 800-53 rev 5 compliance.
Based on the NIST 800-53 rev 5 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_5.html
#### Initializers
```typescript
import { NIST80053R5Checks } from 'cdk-nag'
new NIST80053R5Checks(props?: NagPackProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | NagPackProps | *No description.* |
---
##### `props`Optional
- *Type:* NagPackProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| visit | All aspects can visit an IConstruct. |
---
##### `visit`
```typescript
public visit(node: IConstruct): void
```
All aspects can visit an IConstruct.
###### `node`Required
- *Type:* constructs.IConstruct
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| readPackName | string | *No description.* |
---
##### `readPackName`Required
```typescript
public readonly readPackName: string;
```
- *Type:* string
---
### PCIDSS321Checks
Check for PCI DSS 3.2.1 compliance. Based on the PCI DSS 3.2.1 AWS operational best practices: https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-pci-dss.html.
#### Initializers
```typescript
import { PCIDSS321Checks } from 'cdk-nag'
new PCIDSS321Checks(props?: NagPackProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | NagPackProps | *No description.* |
---
##### `props`Optional
- *Type:* NagPackProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| visit | All aspects can visit an IConstruct. |
---
##### `visit`
```typescript
public visit(node: IConstruct): void
```
All aspects can visit an IConstruct.
###### `node`Required
- *Type:* constructs.IConstruct
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| readPackName | string | *No description.* |
---
##### `readPackName`Required
```typescript
public readonly readPackName: string;
```
- *Type:* string
---
### ServerlessChecks
Serverless Checks are a compilation of rules to validate infrastructure-as-code template against recommended practices.
#### Initializers
```typescript
import { ServerlessChecks } from 'cdk-nag'
new ServerlessChecks(props?: NagPackProps)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| props | NagPackProps | *No description.* |
---
##### `props`Optional
- *Type:* NagPackProps
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| visit | All aspects can visit an IConstruct. |
---
##### `visit`
```typescript
public visit(node: IConstruct): void
```
All aspects can visit an IConstruct.
###### `node`Required
- *Type:* constructs.IConstruct
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| readPackName | string | *No description.* |
---
##### `readPackName`Required
```typescript
public readonly readPackName: string;
```
- *Type:* string
---
### SuppressionIgnoreAlways
- *Implements:* INagSuppressionIgnore
Always ignore the suppression.
#### Initializers
```typescript
import { SuppressionIgnoreAlways } from 'cdk-nag'
new SuppressionIgnoreAlways(triggerMessage: string)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| triggerMessage | string | *No description.* |
---
##### `triggerMessage`Required
- *Type:* string
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| createMessage | *No description.* |
---
##### `createMessage`
```typescript
public createMessage(_input: SuppressionIgnoreInput): string
```
###### `_input`Required
- *Type:* SuppressionIgnoreInput
---
### SuppressionIgnoreAnd
- *Implements:* INagSuppressionIgnore
Ignore the suppression if all of the given INagSuppressionIgnore return a non-empty message.
#### Initializers
```typescript
import { SuppressionIgnoreAnd } from 'cdk-nag'
new SuppressionIgnoreAnd(SuppressionIgnoreAnds: ...INagSuppressionIgnore[])
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| SuppressionIgnoreAnds | ...INagSuppressionIgnore[] | *No description.* |
---
##### `SuppressionIgnoreAnds`Required
- *Type:* ...INagSuppressionIgnore[]
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| createMessage | *No description.* |
---
##### `createMessage`
```typescript
public createMessage(input: SuppressionIgnoreInput): string
```
###### `input`Required
- *Type:* SuppressionIgnoreInput
---
### SuppressionIgnoreErrors
- *Implements:* INagSuppressionIgnore
Ignore Suppressions for Rules with a NagMessageLevel.ERROR.
#### Initializers
```typescript
import { SuppressionIgnoreErrors } from 'cdk-nag'
new SuppressionIgnoreErrors()
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| createMessage | *No description.* |
---
##### `createMessage`
```typescript
public createMessage(input: SuppressionIgnoreInput): string
```
###### `input`Required
- *Type:* SuppressionIgnoreInput
---
### SuppressionIgnoreNever
- *Implements:* INagSuppressionIgnore
Don't ignore the suppression.
#### Initializers
```typescript
import { SuppressionIgnoreNever } from 'cdk-nag'
new SuppressionIgnoreNever()
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| createMessage | *No description.* |
---
##### `createMessage`
```typescript
public createMessage(_input: SuppressionIgnoreInput): string
```
###### `_input`Required
- *Type:* SuppressionIgnoreInput
---
### SuppressionIgnoreOr
- *Implements:* INagSuppressionIgnore
Ignore the suppression if any of the given INagSuppressionIgnore return a non-empty message.
#### Initializers
```typescript
import { SuppressionIgnoreOr } from 'cdk-nag'
new SuppressionIgnoreOr(orSuppressionIgnores: ...INagSuppressionIgnore[])
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| orSuppressionIgnores | ...INagSuppressionIgnore[] | *No description.* |
---
##### `orSuppressionIgnores`Required
- *Type:* ...INagSuppressionIgnore[]
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| createMessage | *No description.* |
---
##### `createMessage`
```typescript
public createMessage(input: SuppressionIgnoreInput): string
```
###### `input`Required
- *Type:* SuppressionIgnoreInput
---
## Protocols
### IApplyRule
- *Implemented By:* IApplyRule
Interface for JSII interoperability for passing parameters and the Rule Callback to.
#### Methods
| **Name** | **Description** |
| --- | --- |
| rule | The callback to the rule. |
---
##### `rule`
```typescript
public rule(node: CfnResource): NagRuleCompliance | string[]
```
The callback to the rule.
###### `node`Required
- *Type:* aws-cdk-lib.CfnResource
The CfnResource to check.
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| explanation | string | Why the rule exists. |
| info | string | Why the rule was triggered. |
| level | NagMessageLevel | The annotations message level to apply to the rule if triggered. |
| node | aws-cdk-lib.CfnResource | The CfnResource to check. |
| ignoreSuppressionCondition | INagSuppressionIgnore | A condition in which a suppression should be ignored. |
| ruleSuffixOverride | string | Override for the suffix of the Rule ID for this rule. |
---
##### `explanation`Required
```typescript
public readonly explanation: string;
```
- *Type:* string
Why the rule exists.
---
##### `info`Required
```typescript
public readonly info: string;
```
- *Type:* string
Why the rule was triggered.
---
##### `level`Required
```typescript
public readonly level: NagMessageLevel;
```
- *Type:* NagMessageLevel
The annotations message level to apply to the rule if triggered.
---
##### `node`Required
```typescript
public readonly node: CfnResource;
```
- *Type:* aws-cdk-lib.CfnResource
The CfnResource to check.
---
##### `ignoreSuppressionCondition`Optional
```typescript
public readonly ignoreSuppressionCondition: INagSuppressionIgnore;
```
- *Type:* INagSuppressionIgnore
A condition in which a suppression should be ignored.
---
##### `ruleSuffixOverride`Optional
```typescript
public readonly ruleSuffixOverride: string;
```
- *Type:* string
Override for the suffix of the Rule ID for this rule.
---
### INagLogger
- *Implemented By:* AnnotationLogger, NagReportLogger, INagLogger
Interface for creating NagSuppression Ignores.
#### Methods
| **Name** | **Description** |
| --- | --- |
| onCompliance | Called when a CfnResource passes the compliance check for a given rule. |
| onError | Called when a rule throws an error during while validating a CfnResource for compliance. |
| onNonCompliance | Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user. |
| onNotApplicable | Called when a rule does not apply to the given CfnResource. |
| onSuppressed | Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user. |
| onSuppressedError | Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed. |
---
##### `onCompliance`
```typescript
public onCompliance(data: NagLoggerComplianceData): void
```
Called when a CfnResource passes the compliance check for a given rule.
###### `data`Required
- *Type:* NagLoggerComplianceData
---
##### `onError`
```typescript
public onError(data: NagLoggerErrorData): void
```
Called when a rule throws an error during while validating a CfnResource for compliance.
###### `data`Required
- *Type:* NagLoggerErrorData
---
##### `onNonCompliance`
```typescript
public onNonCompliance(data: NagLoggerNonComplianceData): void
```
Called when a CfnResource does not pass the compliance check for a given rule and the the rule violation is not suppressed by the user.
###### `data`Required
- *Type:* NagLoggerNonComplianceData
---
##### `onNotApplicable`
```typescript
public onNotApplicable(data: NagLoggerNotApplicableData): void
```
Called when a rule does not apply to the given CfnResource.
###### `data`Required
- *Type:* NagLoggerNotApplicableData
---
##### `onSuppressed`
```typescript
public onSuppressed(data: NagLoggerSuppressedData): void
```
Called when a CfnResource does not pass the compliance check for a given rule and the rule violation is suppressed by the user.
###### `data`Required
- *Type:* NagLoggerSuppressedData
---
##### `onSuppressedError`
```typescript
public onSuppressedError(data: NagLoggerSuppressedErrorData): void
```
Called when a rule throws an error during while validating a CfnResource for compliance and the error is suppressed.
###### `data`Required
- *Type:* NagLoggerSuppressedErrorData
---
### INagSuppressionIgnore
- *Implemented By:* SuppressionIgnoreAlways, SuppressionIgnoreAnd, SuppressionIgnoreErrors, SuppressionIgnoreNever, SuppressionIgnoreOr, INagSuppressionIgnore
Interface for creating NagSuppression Ignores.
#### Methods
| **Name** | **Description** |
| --- | --- |
| createMessage | *No description.* |
---
##### `createMessage`
```typescript
public createMessage(input: SuppressionIgnoreInput): string
```
###### `input`Required
- *Type:* SuppressionIgnoreInput
---
## Enums
### NagMessageLevel
The severity level of the rule.
#### Members
| **Name** | **Description** |
| --- | --- |
| WARN | *No description.* |
| ERROR | *No description.* |
| INFO | *No description.* |
---
##### `WARN`
---
##### `ERROR`
---
##### `INFO`
---
### NagReportFormat
Possible output formats of the NagReport.
#### Members
| **Name** | **Description** |
| --- | --- |
| CSV | *No description.* |
| JSON | *No description.* |
---
##### `CSV`
---
##### `JSON`
---
### NagRuleCompliance
The compliance level of a resource in relation to a rule.
#### Members
| **Name** | **Description** |
| --- | --- |
| COMPLIANT | *No description.* |
| NON_COMPLIANT | *No description.* |
| NOT_APPLICABLE | *No description.* |
---
##### `COMPLIANT`
---
##### `NON_COMPLIANT`
---
##### `NOT_APPLICABLE`
---
### NagRulePostValidationStates
Additional states a rule can be in post compliance validation.
#### Members
| **Name** | **Description** |
| --- | --- |
| SUPPRESSED | *No description.* |
| UNKNOWN | *No description.* |
---
##### `SUPPRESSED`
---
##### `UNKNOWN`
---