Nationwide Polamorous Matrimony

    TypeScript icon, indicating that this package has built-in type declarations

    2.0.5 • Public • Published

    k9 AWS CDK policy library

    k9 Security's k9-cdk for CDKv2 makes strong security usable and helps you provision best practice AWS security policies defined using the simplified k9 access capability model and safe defaults. In CDK terms, this library provides Curated (L2) constructs that wrap core CloudFormation resources (L1) to simplify security.

    Supported services:

    • S3
    • KMS


    Use the k9 CDK to generate a policy and use it in your existing code base.

    For example, the following code will:

    1. provision an S3 Bucket
    2. allow the ci and person1 users to administer the bucket
    3. allow administrators and k9-auditor to read bucket configuration
    4. allow the app-backend role to write data into the bucket
    5. allow the app-backend and customer-service role to read data in the bucket
    import * as cdk from "aws-cdk-lib";
    import * as s3 from "aws-cdk-lib/aws-s3";
    import * as k9 from "@k9securityio/k9-cdk";
    // Define which principals may access the bucket and what capabilities they should have
    const administerResourceArns = [
    const readConfigArns = administerResourceArns.concat([
    const app = new cdk.App();
    const stack = new cdk.Stack(app, 'K9Example');
    const bucket = new s3.Bucket(stack, 'TestBucket', {});
    const k9BucketPolicyProps: k9.s3.K9BucketPolicyProps = {
        bucket: bucket,
        k9DesiredAccess: new Array<k9.k9policy.IAccessSpec>(
             {   // declare access capabilities individually
                 accessCapability: k9.k9policy.AccessCapability.ADMINISTER_RESOURCE,
                 allowPrincipalArns: administerResourceArns,
                 accessCapability: k9.k9policy.AccessCapability.READ_CONFIG,
                 allowPrincipalArns: readConfigArns,
            {  // or declare multiple access capabilities at once
                accessCapabilities: [
                allowPrincipalArns: [
                 accessCapability: k9.k9policy.AccessCapability.READ_DATA,
                 allowPrincipalArns: [
             // omit access spec for delete-data because it is unneeded
    k9.s3.grantAccessViaResourcePolicy(stack, "S3Bucket", k9BucketPolicyProps);

    Granting access to a KMS key is similar, but the custom resource policy is created first so it can be set via props per CDK convention:

    import * as kms from "aws-cdk-lib/aws-kms"; 
    import {PolicyDocument} from "aws-cdk-lib/aws-iam";
    const k9KeyPolicyProps: k9.kms.K9KeyPolicyProps = {
        k9DesiredAccess: k9BucketPolicyProps.k9DesiredAccess
    const keyPolicy: PolicyDocument = k9.kms.makeKeyPolicy(k9KeyPolicyProps);
    new kms.Key(stack, 'KMSKey', {
        alias: 'app-key-with-k9-policy',
        policy: keyPolicy

    The example stack demonstrates full use of the k9 S3 and KMS policy generators. Generated policies:

    S3 Bucket Policy:

    KMS Key Policy:

    Specialized Use Cases

    k9-cdk can be configured to support specialized use cases, including:

    • Public Bucket - Publicaly readable objects, least privilege for all other actions

    Local Development and Testing

    The high level build commands for this project are driven by make:

    • make all - build library, run tests, and deploy
    • make build - build the library
    • make converge - deploy the integration test resources
    • make destroy - destroy the integration test resources

    The low level build commands for this project are:

    • npx projen build compile typescript to js, lint, transpile with JSII, execute tests
    • cdk synth emits the synthesized CloudFormation template
    • cdk deploy deploy this stack to your default AWS account/region
    • cdk diff compare deployed stack with current state


    npm i @k9securityio/k9-cdk

    DownloadsWeekly Downloads






    Unpacked Size

    299 kB

    Total Files


    Last publish


    • k9securityio-dist