AWS CDK

What’s scanned

• CDK project definitions (language-based IaC) and generated or defined infrastructure patterns
• High-risk configurations: public endpoints, wide permissions, missing encryption/logging

How to think about CDK scanning

CDK is code-driven IaC; issues are still raised as IaC Security findings and tied to your rules, not just code smells.