Cursor Rules Aws Cdk: Stop AI From Inventing IAM Wildcards

# AWS CDK IAM law
- Never emit IAM `Action: "*"` or `Resource: "*"` unless the file is under `/stacks/break-glass/` and labeled BREAK_GLASS.
- Prefer `table.grantReadData(fn)` / `bucket.grantRead(fn)` over hand-written PolicyStatements.
- SecurityGroup ingress: no `Peer.anyIpv4()` on prod stacks; use prefix lists or VPC CIDR.
- S3: `BlockPublicAccess.BLOCK_ALL`, encryption mandatory, no `BUCKET_OWNER_PREFERRED` without reason.
- When unsure of ARN, add a TODO + narrow placeholder — do not widen to `*`.

// .cursor/rules encoded as a lintable constant the agent must import
export const CDK_AGENT_LAW = {
  forbidActionWildcard: true,
  forbidResourceWildcard: true,
  forbidAnyIpv4Ingress: true,
  requireBucketBlockPublic: true,
} as const;

// lib/aspects/no-wildcards.ts
import * as cdk from "aws-cdk-lib";
import { IConstruct } from "constructs";
import * as iam from "aws-cdk-lib/aws-iam";

export class NoIamWildcards implements cdk.IAspect {
  visit(node: IConstruct) {
    if (!(node instanceof iam.CfnPolicy) && !(node instanceof iam.CfnManagedPolicy)) return;
    const doc = (node as any).policyDocument ?? (node as any).policyDocument;
    // Normalize to JSON
    const raw = JSON.stringify(node);
    // ✅ Cheap static deny — refine with PolicyDocument parsing in real packs
    if (/"Action"\s*:\s*"\*"/i.test(raw) || /"Action"\s*:\s*\[\s*"\*"/i.test(raw)) {
      cdk.Annotations.of(node).addError("IAM Action wildcard forbidden by aspect");
    }
    if (/"Resource"\s*:\s*"\*"/i.test(raw)) {
      cdk.Annotations.of(node).addError("IAM Resource wildcard forbidden by aspect");
    }
  }
}

// app.ts
const app = new cdk.App();
const stack = new CheckoutStack(app, "CheckoutProd");
cdk.Aspects.of(app).add(new NoIamWildcards());

// ✅ Agent-friendly pattern
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as lambda from "aws-cdk-lib/aws-lambda";

declare const table: dynamodb.Table;
declare const fn: lambda.Function;
table.grantReadData(fn); // precise actions + table ARN + indexes

// ❌ What models invent
fn.addToRolePolicy(new iam.PolicyStatement({
  actions: ["dynamodb:*"],
  resources: ["*"],
}));

// When you must hand-write, pin ARNs from constructs
fn.addToRolePolicy(new iam.PolicyStatement({
  actions: ["dynamodb:GetItem", "dynamodb:Query"],
  resources: [table.tableArn, `${table.tableArn}/index/*`],
}));

// ❌ Prod anti-pattern the rule must ban
sg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), "temp open");

// ✅
sg.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcp(443));

// S3
new s3.Bucket(this, "Assets", {
  blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
  encryption: s3.BucketEncryption.S3_MANAGED,
  enforceSSL: true,
});

# .github/workflows/cdk.yml
- name: Synth with nag
  run: |
    npx cdk synth -q
    # Annotations.addError fails synth when --strict / app throws via Aspects
- name: Diff attach policy wildcards
  run: |
    ! git diff origin/main...HEAD | grep -E 'Action:\s*"\*"|"Action"\s*:\s*"\*"'